{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 1,
  "id": null,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "id": 1,
      "type": "stat",
      "title": "Core sensor",
      "description": "Minimum state across exported core components.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 0,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bool",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "green",
                "value": 1
              }
            ]
          },
          "color": {
            "mode": "thresholds"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "min(mikrosuricata_component_up{instance=~\"$instance\"})",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 20,
      "type": "stat",
      "title": "Total throughput",
      "description": "Current captured TZSP throughput across all traffic directions.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 4,
        "y": 0,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bps",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "orange",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "orange"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 21,
      "type": "stat",
      "title": "Inbound",
      "description": "Traffic entering monitored networks.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 8,
        "y": 0,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bps",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "#5794F2",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "#5794F2"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"inbound\"}[$__rate_interval]))",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 22,
      "type": "stat",
      "title": "Outbound",
      "description": "Traffic leaving monitored networks.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 12,
        "y": 0,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bps",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "#73BF69",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "#73BF69"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"outbound\"}[$__rate_interval]))",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 23,
      "type": "stat",
      "title": "Packet rate",
      "description": "Packets per second observed from TZSP.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 16,
        "y": 0,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "pps",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "#B877D9",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "#B877D9"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_traffic_packets_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 4,
      "type": "stat",
      "title": "Capture drops",
      "description": "Suricata kernel capture drops as a percentage of captured packets.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 20,
        "y": 0,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "percent",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "yellow",
                "value": 0.2
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          },
          "color": {
            "mode": "thresholds"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "100 * sum(rate(mikrosuricata_suricata_capture_kernel_drops{instance=~\"$instance\"}[$__rate_interval])) / clamp_min(sum(rate(mikrosuricata_suricata_capture_kernel_packets{instance=~\"$instance\"}[$__rate_interval])), 1)",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 24,
      "type": "timeseries",
      "title": "Traffic throughput",
      "description": "Real captured bandwidth from monotonic TZSP byte counters. Total includes inbound, outbound, internal and external traffic.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 4,
        "w": 16,
        "h": 9
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bps",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 14,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "min": 0
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Total"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "orange"
                }
              },
              {
                "id": "custom.lineWidth",
                "value": 3
              },
              {
                "id": "custom.fillOpacity",
                "value": 24
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Inbound"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#5794F2"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Outbound"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#73BF69"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Internal"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#B877D9"
                }
              },
              {
                "id": "custom.lineWidth",
                "value": 1
              },
              {
                "id": "custom.fillOpacity",
                "value": 4
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "External"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#8AB8FF"
                }
              },
              {
                "id": "custom.lineWidth",
                "value": 1
              },
              {
                "id": "custom.fillOpacity",
                "value": 4
              }
            ]
          }
        ]
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
          "legendFormat": "Total",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"inbound\"}[$__rate_interval]))",
          "legendFormat": "Inbound",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"outbound\"}[$__rate_interval]))",
          "legendFormat": "Outbound",
          "range": true,
          "refId": "C"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"internal\"}[$__rate_interval]))",
          "legendFormat": "Internal",
          "range": true,
          "refId": "D"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"external\"}[$__rate_interval]))",
          "legendFormat": "External",
          "range": true,
          "refId": "E"
        }
      ]
    },
    {
      "id": 25,
      "type": "bargauge",
      "title": "Traffic mix \u00b7 selected range",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 16,
        "y": 4,
        "w": 8,
        "h": 9
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bytes",
          "color": {
            "mode": "continuous-GrYlRd"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Inbound"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#5794F2"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Outbound"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#73BF69"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Internal"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#B877D9"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "External"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "mode": "fixed",
                  "fixedColor": "#8AB8FF"
                }
              }
            ]
          }
        ]
      },
      "options": {
        "displayMode": "gradient",
        "minVizHeight": 10,
        "minVizWidth": 0,
        "namePlacement": "auto",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "sizing": "auto",
        "valueMode": "color"
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"inbound\"}[$__range]))",
          "legendFormat": "Inbound",
          "range": false,
          "refId": "A",
          "instant": true
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"outbound\"}[$__range]))",
          "legendFormat": "Outbound",
          "range": false,
          "refId": "B",
          "instant": true
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"internal\"}[$__range]))",
          "legendFormat": "Internal",
          "range": false,
          "refId": "C",
          "instant": true
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"external\"}[$__range]))",
          "legendFormat": "External",
          "range": false,
          "refId": "D",
          "instant": true
        }
      ],
      "description": "Volume observed during the currently selected Grafana time range."
    },
    {
      "id": 3,
      "type": "stat",
      "title": "Alerts / s",
      "description": "Suricata EVE alert rate.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 13,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "ops",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "red"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_eve_alerts_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 26,
      "type": "stat",
      "title": "Active flows",
      "description": "Currently tracked live L3/L4 flows.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 4,
        "y": 13,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "#5794F2",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "#5794F2"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_flow_tracker_active_flows{instance=~\"$instance\"})",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 5,
      "type": "stat",
      "title": "NDR queue",
      "description": "",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 8,
        "y": 13,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "yellow",
                "value": 1000
              },
              {
                "color": "red",
                "value": 10000
              }
            ]
          },
          "color": {
            "mode": "thresholds"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_ndr_queue{instance=~\"$instance\"})",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 6,
      "type": "stat",
      "title": "Last packet age",
      "description": "",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 12,
        "y": 13,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "s",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "yellow",
                "value": 30
              },
              {
                "color": "red",
                "value": 120
              }
            ]
          },
          "color": {
            "mode": "thresholds"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "time() - max(mikrosuricata_last_packet_timestamp_seconds{instance=~\"$instance\"})",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 27,
      "type": "stat",
      "title": "Peak throughput",
      "description": "Highest total captured throughput in the selected Grafana time range.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 16,
        "y": 13,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "bps",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "orange",
                "value": null
              }
            ]
          },
          "color": {
            "mode": "fixed",
            "fixedColor": "orange"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "max"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 17,
      "type": "stat",
      "title": "Suricata stats age",
      "description": "",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 20,
        "y": 13,
        "w": 4,
        "h": 4
      },
      "fieldConfig": {
        "defaults": {
          "unit": "s",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "yellow",
                "value": 60
              },
              {
                "color": "red",
                "value": 180
              }
            ]
          },
          "color": {
            "mode": "thresholds"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "time() - max(mikrosuricata_suricata_stats_timestamp_seconds{instance=~\"$instance\"})",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 7,
      "type": "timeseries",
      "title": "Packet pipeline",
      "description": "Packet-rate comparison from TZSP ingest through TAP injection to Suricata capture.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 17,
        "w": 12,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "pps",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_tzsp_datagrams_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "TZSP datagrams",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_frames_injected_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "TAP injected",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_suricata_capture_kernel_packets{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Suricata captured",
          "range": true,
          "refId": "C"
        }
      ]
    },
    {
      "id": 8,
      "type": "timeseries",
      "title": "Sensor loss & decode errors",
      "description": "Rates that should stay near zero: kernel drops, injection errors, TZSP decode errors and Suricata alert queue overflow.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 12,
        "y": 17,
        "w": 12,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "ops",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_suricata_capture_kernel_drops{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Kernel drops",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_inject_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "TAP inject errors",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_tzsp_decode_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "TZSP decode errors",
          "range": true,
          "refId": "C"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_suricata_detect_alert_queue_overflow{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Alert queue overflow",
          "range": true,
          "refId": "D"
        }
      ]
    },
    {
      "id": 9,
      "type": "timeseries",
      "title": "Alert pipeline",
      "description": "Alert generation, filtering, deduplication and EVE parse errors.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 25,
        "w": 12,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "ops",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_eve_alerts_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "EVE alerts",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_alerts_filtered_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Filtered",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_alerts_deduplicated_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Deduplicated",
          "range": true,
          "refId": "C"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_eve_parse_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "EVE parse errors",
          "range": true,
          "refId": "D"
        }
      ]
    },
    {
      "id": 10,
      "type": "timeseries",
      "title": "Automatic blocking",
      "description": "Automatic response attempts, successful blocks and errors.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 12,
        "y": 25,
        "w": 12,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "ops",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_block_attempts_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Attempts",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_block_success_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Success",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_block_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Errors",
          "range": true,
          "refId": "C"
        }
      ]
    },
    {
      "id": 11,
      "type": "timeseries",
      "title": "Live writer / Redis path",
      "description": "Live-history writer pressure and Redis failures.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 33,
        "w": 8,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_live_pipeline_writer_queue{instance=~\"$instance\"})",
          "legendFormat": "Queue",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_live_pipeline_writer_dropped_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Dropped/s",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_live_pipeline_writer_redis_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Redis errors/s",
          "range": true,
          "refId": "C"
        }
      ]
    },
    {
      "id": 12,
      "type": "timeseries",
      "title": "NDR activity",
      "description": "NDR queue depth, generated signals, IOC/behavior hits and drops.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 8,
        "y": 33,
        "w": 8,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_ndr_queue{instance=~\"$instance\"})",
          "legendFormat": "Queue",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_ndr_signals_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Signals/s",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_ndr_ioc_hits_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "IOC hits/s",
          "range": true,
          "refId": "C"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_ndr_behavior_hits_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Behavior hits/s",
          "range": true,
          "refId": "D"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_ndr_dropped_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Dropped/s",
          "range": true,
          "refId": "E"
        }
      ]
    },
    {
      "id": 13,
      "type": "timeseries",
      "title": "Notifications",
      "description": "Notification queue and delivery outcomes.",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 16,
        "y": 33,
        "w": 8,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_notifier_queue{instance=~\"$instance\"})",
          "legendFormat": "Queue",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_notifier_sent_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Sent/s",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_notifier_failed_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Failed/s",
          "range": true,
          "refId": "C"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_notifier_dropped_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Dropped/s",
          "range": true,
          "refId": "D"
        }
      ]
    },
    {
      "id": 14,
      "type": "timeseries",
      "title": "Live sessions",
      "description": "",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 41,
        "w": 8,
        "h": 7
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_flow_tracker_active_flows{instance=~\"$instance\"})",
          "legendFormat": "Active flows",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_event_bus_subscribers{instance=~\"$instance\"})",
          "legendFormat": "WebSocket subscribers",
          "range": true,
          "refId": "B"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "sum(rate(mikrosuricata_flow_tracker_evicted_flows_total{instance=~\"$instance\"}[$__rate_interval]))",
          "legendFormat": "Evictions/s",
          "range": true,
          "refId": "C"
        }
      ]
    },
    {
      "id": 15,
      "type": "timeseries",
      "title": "Forensic PCAP ring",
      "description": "",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 8,
        "y": 41,
        "w": 8,
        "h": 7
      },
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "barAlignment": 0,
            "lineWidth": 2,
            "fillOpacity": 12,
            "gradientMode": "opacity",
            "spanNulls": true,
            "insertNulls": false,
            "showPoints": "never",
            "pointSize": 5,
            "stacking": {
              "mode": "none",
              "group": "A"
            },
            "axisPlacement": "auto",
            "axisLabel": "",
            "axisColorMode": "text",
            "axisBorderShow": false,
            "scaleDistribution": {
              "type": "linear"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "color": {
            "mode": "palette-classic"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull",
            "mean",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc",
          "hideZeros": false
        }
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_forensic_pcap_buffered_bytes{instance=~\"$instance\"})",
          "legendFormat": "Buffered bytes",
          "range": true,
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "max(mikrosuricata_forensic_pcap_buffered_frames{instance=~\"$instance\"})",
          "legendFormat": "Buffered frames",
          "range": true,
          "refId": "B"
        }
      ]
    },
    {
      "id": 16,
      "type": "stat",
      "title": "PCAP memory utilization",
      "description": "",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 16,
        "y": 41,
        "w": 8,
        "h": 7
      },
      "fieldConfig": {
        "defaults": {
          "unit": "percent",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "yellow",
                "value": 70
              },
              {
                "color": "red",
                "value": 90
              }
            ]
          },
          "color": {
            "mode": "thresholds"
          }
        },
        "overrides": []
      },
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto",
        "wideLayout": true
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "100 * max(mikrosuricata_forensic_pcap_buffered_bytes{instance=~\"$instance\"}) / clamp_min(max(mikrosuricata_forensic_pcap_memory_bytes{instance=~\"$instance\"}), 1)",
          "legendFormat": "",
          "range": true,
          "refId": "A"
        }
      ]
    },
    {
      "id": 18,
      "type": "bargauge",
      "title": "Core components",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 0,
        "y": 48,
        "w": 12,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "min": 0,
          "max": 1,
          "unit": "bool",
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "green",
                "value": 1
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "displayMode": "gradient",
        "minVizHeight": 10,
        "minVizWidth": 0,
        "namePlacement": "auto",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "sizing": "auto",
        "valueMode": "color"
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "mikrosuricata_component_up{instance=~\"$instance\"}",
          "legendFormat": "{{component}}",
          "range": false,
          "refId": "A",
          "instant": true
        }
      ]
    },
    {
      "id": 19,
      "type": "bargauge",
      "title": "Feature switches",
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "gridPos": {
        "x": 12,
        "y": 48,
        "w": 12,
        "h": 8
      },
      "fieldConfig": {
        "defaults": {
          "min": 0,
          "max": 1,
          "unit": "bool",
          "color": {
            "mode": "thresholds"
          },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "green",
                "value": 1
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "displayMode": "gradient",
        "minVizHeight": 10,
        "minVizWidth": 0,
        "namePlacement": "auto",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "showUnfilled": true,
        "sizing": "auto",
        "valueMode": "color"
      },
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "editorMode": "code",
          "expr": "mikrosuricata_feature_enabled{instance=~\"$instance\"}",
          "legendFormat": "{{feature}}",
          "range": false,
          "refId": "A",
          "instant": true
        }
      ]
    }
  ],
  "refresh": "30s",
  "schemaVersion": 39,
  "tags": [
    "mikrosuricata",
    "suricata",
    "ids",
    "prometheus",
    "routeros",
    "traffic",
    "ndr"
  ],
  "templating": {
    "list": [
      {
        "current": {},
        "hide": 0,
        "includeAll": false,
        "label": "Prometheus",
        "multi": false,
        "name": "datasource",
        "options": [],
        "query": "prometheus",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "current": {},
        "datasource": {
          "type": "prometheus",
          "uid": "${datasource}"
        },
        "definition": "label_values(mikrosuricata_build_info, instance)",
        "hide": 0,
        "includeAll": true,
        "allValue": ".*",
        "label": "Instance",
        "multi": true,
        "name": "instance",
        "options": [],
        "query": {
          "query": "label_values(mikrosuricata_build_info, instance)",
          "refId": "StandardVariableQuery"
        },
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 1,
        "type": "query"
      }
    ]
  },
  "time": {
    "from": "now-6h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "browser",
  "title": "MikroSuricata / Traffic & Security",
  "uid": "mikrosuricata-prometheus",
  "version": 2,
  "weekStart": "monday",
  "description": "Prometheus dashboard for MikroSuricata traffic throughput, packet pipeline, detection, response and sensor health."
}