2537 lines
63 KiB
JSON
2537 lines
63 KiB
JSON
{
|
|
"annotations": {
|
|
"list": [
|
|
{
|
|
"builtIn": 1,
|
|
"datasource": {
|
|
"type": "grafana",
|
|
"uid": "-- Grafana --"
|
|
},
|
|
"enable": true,
|
|
"hide": true,
|
|
"iconColor": "rgba(0, 211, 255, 1)",
|
|
"name": "Annotations & Alerts",
|
|
"type": "dashboard"
|
|
}
|
|
]
|
|
},
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 1,
|
|
"id": null,
|
|
"links": [],
|
|
"liveNow": false,
|
|
"panels": [
|
|
{
|
|
"id": 1,
|
|
"type": "stat",
|
|
"title": "Core sensor",
|
|
"description": "Minimum state across exported core components.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 0,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bool",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "red",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "green",
|
|
"value": 1
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "thresholds"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "min(mikrosuricata_component_up{instance=~\"$instance\"})",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 20,
|
|
"type": "stat",
|
|
"title": "Total throughput",
|
|
"description": "Current captured TZSP throughput across all traffic directions.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 4,
|
|
"y": 0,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bps",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "orange"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 21,
|
|
"type": "stat",
|
|
"title": "Inbound",
|
|
"description": "Traffic entering monitored networks.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 8,
|
|
"y": 0,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bps",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "#5794F2",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#5794F2"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"inbound\"}[$__rate_interval]))",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 22,
|
|
"type": "stat",
|
|
"title": "Outbound",
|
|
"description": "Traffic leaving monitored networks.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 0,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bps",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "#73BF69",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#73BF69"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"outbound\"}[$__rate_interval]))",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 23,
|
|
"type": "stat",
|
|
"title": "Packet rate",
|
|
"description": "Packets per second observed from TZSP.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 16,
|
|
"y": 0,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "pps",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "#B877D9",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#B877D9"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_traffic_packets_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 4,
|
|
"type": "stat",
|
|
"title": "Capture drops",
|
|
"description": "Suricata kernel capture drops as a percentage of captured packets.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 20,
|
|
"y": 0,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "percent",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "yellow",
|
|
"value": 0.2
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 1
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "thresholds"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "100 * sum(rate(mikrosuricata_suricata_capture_kernel_drops{instance=~\"$instance\"}[$__rate_interval])) / clamp_min(sum(rate(mikrosuricata_suricata_capture_kernel_packets{instance=~\"$instance\"}[$__rate_interval])), 1)",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 24,
|
|
"type": "timeseries",
|
|
"title": "Traffic throughput",
|
|
"description": "Real captured bandwidth from monotonic TZSP byte counters. Total includes inbound, outbound, internal and external traffic.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 4,
|
|
"w": 16,
|
|
"h": 9
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bps",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 14,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"min": 0
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Total"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "orange"
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.lineWidth",
|
|
"value": 3
|
|
},
|
|
{
|
|
"id": "custom.fillOpacity",
|
|
"value": 24
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Inbound"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#5794F2"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Outbound"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#73BF69"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Internal"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#B877D9"
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.lineWidth",
|
|
"value": 1
|
|
},
|
|
{
|
|
"id": "custom.fillOpacity",
|
|
"value": 4
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "External"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#8AB8FF"
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.lineWidth",
|
|
"value": 1
|
|
},
|
|
{
|
|
"id": "custom.fillOpacity",
|
|
"value": 4
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
|
|
"legendFormat": "Total",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"inbound\"}[$__rate_interval]))",
|
|
"legendFormat": "Inbound",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"outbound\"}[$__rate_interval]))",
|
|
"legendFormat": "Outbound",
|
|
"range": true,
|
|
"refId": "C"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"internal\"}[$__rate_interval]))",
|
|
"legendFormat": "Internal",
|
|
"range": true,
|
|
"refId": "D"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"external\"}[$__rate_interval]))",
|
|
"legendFormat": "External",
|
|
"range": true,
|
|
"refId": "E"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 25,
|
|
"type": "bargauge",
|
|
"title": "Traffic mix \u00b7 selected range",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 16,
|
|
"y": 4,
|
|
"w": 8,
|
|
"h": 9
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bytes",
|
|
"color": {
|
|
"mode": "continuous-GrYlRd"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Inbound"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#5794F2"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Outbound"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#73BF69"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Internal"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#B877D9"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "External"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#8AB8FF"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"options": {
|
|
"displayMode": "gradient",
|
|
"minVizHeight": 10,
|
|
"minVizWidth": 0,
|
|
"namePlacement": "auto",
|
|
"orientation": "horizontal",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showUnfilled": true,
|
|
"sizing": "auto",
|
|
"valueMode": "color"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"inbound\"}[$__range]))",
|
|
"legendFormat": "Inbound",
|
|
"range": false,
|
|
"refId": "A",
|
|
"instant": true
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"outbound\"}[$__range]))",
|
|
"legendFormat": "Outbound",
|
|
"range": false,
|
|
"refId": "B",
|
|
"instant": true
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"internal\"}[$__range]))",
|
|
"legendFormat": "Internal",
|
|
"range": false,
|
|
"refId": "C",
|
|
"instant": true
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(increase(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"external\"}[$__range]))",
|
|
"legendFormat": "External",
|
|
"range": false,
|
|
"refId": "D",
|
|
"instant": true
|
|
}
|
|
],
|
|
"description": "Volume observed during the currently selected Grafana time range."
|
|
},
|
|
{
|
|
"id": 3,
|
|
"type": "stat",
|
|
"title": "Alerts / s",
|
|
"description": "Suricata EVE alert rate.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 13,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "ops",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "red"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_eve_alerts_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 26,
|
|
"type": "stat",
|
|
"title": "Active flows",
|
|
"description": "Currently tracked live L3/L4 flows.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 4,
|
|
"y": 13,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "#5794F2",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "#5794F2"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_flow_tracker_active_flows{instance=~\"$instance\"})",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 5,
|
|
"type": "stat",
|
|
"title": "NDR queue",
|
|
"description": "",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 8,
|
|
"y": 13,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "yellow",
|
|
"value": 1000
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 10000
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "thresholds"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_ndr_queue{instance=~\"$instance\"})",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 6,
|
|
"type": "stat",
|
|
"title": "Last packet age",
|
|
"description": "",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 13,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "s",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "yellow",
|
|
"value": 30
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 120
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "thresholds"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "time() - max(mikrosuricata_last_packet_timestamp_seconds{instance=~\"$instance\"})",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 27,
|
|
"type": "stat",
|
|
"title": "Peak throughput",
|
|
"description": "Highest total captured throughput in the selected Grafana time range.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 16,
|
|
"y": 13,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bps",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "orange"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"max"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "8 * sum(rate(mikrosuricata_traffic_bytes_total{instance=~\"$instance\",direction=\"total\"}[$__rate_interval]))",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 17,
|
|
"type": "stat",
|
|
"title": "Suricata stats age",
|
|
"description": "",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 20,
|
|
"y": 13,
|
|
"w": 4,
|
|
"h": 4
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "s",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "yellow",
|
|
"value": 60
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 180
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "thresholds"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "time() - max(mikrosuricata_suricata_stats_timestamp_seconds{instance=~\"$instance\"})",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 7,
|
|
"type": "timeseries",
|
|
"title": "Packet pipeline",
|
|
"description": "Packet-rate comparison from TZSP ingest through TAP injection to Suricata capture.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 17,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "pps",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_tzsp_datagrams_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "TZSP datagrams",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_frames_injected_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "TAP injected",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_suricata_capture_kernel_packets{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Suricata captured",
|
|
"range": true,
|
|
"refId": "C"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 8,
|
|
"type": "timeseries",
|
|
"title": "Sensor loss & decode errors",
|
|
"description": "Rates that should stay near zero: kernel drops, injection errors, TZSP decode errors and Suricata alert queue overflow.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 17,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "ops",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_suricata_capture_kernel_drops{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Kernel drops",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_inject_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "TAP inject errors",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_tzsp_decode_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "TZSP decode errors",
|
|
"range": true,
|
|
"refId": "C"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_suricata_detect_alert_queue_overflow{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Alert queue overflow",
|
|
"range": true,
|
|
"refId": "D"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 9,
|
|
"type": "timeseries",
|
|
"title": "Alert pipeline",
|
|
"description": "Alert generation, filtering, deduplication and EVE parse errors.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 25,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "ops",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_eve_alerts_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "EVE alerts",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_alerts_filtered_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Filtered",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_alerts_deduplicated_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Deduplicated",
|
|
"range": true,
|
|
"refId": "C"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_eve_parse_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "EVE parse errors",
|
|
"range": true,
|
|
"refId": "D"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 10,
|
|
"type": "timeseries",
|
|
"title": "Automatic blocking",
|
|
"description": "Automatic response attempts, successful blocks and errors.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 25,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "ops",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_block_attempts_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Attempts",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_block_success_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Success",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_block_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Errors",
|
|
"range": true,
|
|
"refId": "C"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 11,
|
|
"type": "timeseries",
|
|
"title": "Live writer / Redis path",
|
|
"description": "Live-history writer pressure and Redis failures.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 33,
|
|
"w": 8,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_live_pipeline_writer_queue{instance=~\"$instance\"})",
|
|
"legendFormat": "Queue",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_live_pipeline_writer_dropped_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Dropped/s",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_live_pipeline_writer_redis_errors_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Redis errors/s",
|
|
"range": true,
|
|
"refId": "C"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 12,
|
|
"type": "timeseries",
|
|
"title": "NDR activity",
|
|
"description": "NDR queue depth, generated signals, IOC/behavior hits and drops.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 8,
|
|
"y": 33,
|
|
"w": 8,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_ndr_queue{instance=~\"$instance\"})",
|
|
"legendFormat": "Queue",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_ndr_signals_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Signals/s",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_ndr_ioc_hits_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "IOC hits/s",
|
|
"range": true,
|
|
"refId": "C"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_ndr_behavior_hits_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Behavior hits/s",
|
|
"range": true,
|
|
"refId": "D"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_ndr_dropped_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Dropped/s",
|
|
"range": true,
|
|
"refId": "E"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 13,
|
|
"type": "timeseries",
|
|
"title": "Notifications",
|
|
"description": "Notification queue and delivery outcomes.",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 16,
|
|
"y": 33,
|
|
"w": 8,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_notifier_queue{instance=~\"$instance\"})",
|
|
"legendFormat": "Queue",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_notifier_sent_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Sent/s",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_notifier_failed_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Failed/s",
|
|
"range": true,
|
|
"refId": "C"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_notifier_dropped_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Dropped/s",
|
|
"range": true,
|
|
"refId": "D"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 14,
|
|
"type": "timeseries",
|
|
"title": "Live sessions",
|
|
"description": "",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 41,
|
|
"w": 8,
|
|
"h": 7
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_flow_tracker_active_flows{instance=~\"$instance\"})",
|
|
"legendFormat": "Active flows",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_event_bus_subscribers{instance=~\"$instance\"})",
|
|
"legendFormat": "WebSocket subscribers",
|
|
"range": true,
|
|
"refId": "B"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(rate(mikrosuricata_flow_tracker_evicted_flows_total{instance=~\"$instance\"}[$__rate_interval]))",
|
|
"legendFormat": "Evictions/s",
|
|
"range": true,
|
|
"refId": "C"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 15,
|
|
"type": "timeseries",
|
|
"title": "Forensic PCAP ring",
|
|
"description": "",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 8,
|
|
"y": 41,
|
|
"w": 8,
|
|
"h": 7
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"barAlignment": 0,
|
|
"lineWidth": 2,
|
|
"fillOpacity": 12,
|
|
"gradientMode": "opacity",
|
|
"spanNulls": true,
|
|
"insertNulls": false,
|
|
"showPoints": "never",
|
|
"pointSize": 5,
|
|
"stacking": {
|
|
"mode": "none",
|
|
"group": "A"
|
|
},
|
|
"axisPlacement": "auto",
|
|
"axisLabel": "",
|
|
"axisColorMode": "text",
|
|
"axisBorderShow": false,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [
|
|
"lastNotNull",
|
|
"mean",
|
|
"max"
|
|
],
|
|
"displayMode": "table",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc",
|
|
"hideZeros": false
|
|
}
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_forensic_pcap_buffered_bytes{instance=~\"$instance\"})",
|
|
"legendFormat": "Buffered bytes",
|
|
"range": true,
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "max(mikrosuricata_forensic_pcap_buffered_frames{instance=~\"$instance\"})",
|
|
"legendFormat": "Buffered frames",
|
|
"range": true,
|
|
"refId": "B"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 16,
|
|
"type": "stat",
|
|
"title": "PCAP memory utilization",
|
|
"description": "",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 16,
|
|
"y": 41,
|
|
"w": 8,
|
|
"h": 7
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "percent",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "yellow",
|
|
"value": 70
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 90
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "thresholds"
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "100 * max(mikrosuricata_forensic_pcap_buffered_bytes{instance=~\"$instance\"}) / clamp_min(max(mikrosuricata_forensic_pcap_memory_bytes{instance=~\"$instance\"}), 1)",
|
|
"legendFormat": "",
|
|
"range": true,
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 18,
|
|
"type": "bargauge",
|
|
"title": "Core components",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 48,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"min": 0,
|
|
"max": 1,
|
|
"unit": "bool",
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "red",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "green",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"displayMode": "gradient",
|
|
"minVizHeight": 10,
|
|
"minVizWidth": 0,
|
|
"namePlacement": "auto",
|
|
"orientation": "horizontal",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showUnfilled": true,
|
|
"sizing": "auto",
|
|
"valueMode": "color"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "mikrosuricata_component_up{instance=~\"$instance\"}",
|
|
"legendFormat": "{{component}}",
|
|
"range": false,
|
|
"refId": "A",
|
|
"instant": true
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 19,
|
|
"type": "bargauge",
|
|
"title": "Feature switches",
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 48,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"min": 0,
|
|
"max": 1,
|
|
"unit": "bool",
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "red",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "green",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"displayMode": "gradient",
|
|
"minVizHeight": 10,
|
|
"minVizWidth": 0,
|
|
"namePlacement": "auto",
|
|
"orientation": "horizontal",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showUnfilled": true,
|
|
"sizing": "auto",
|
|
"valueMode": "color"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "mikrosuricata_feature_enabled{instance=~\"$instance\"}",
|
|
"legendFormat": "{{feature}}",
|
|
"range": false,
|
|
"refId": "A",
|
|
"instant": true
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"refresh": "30s",
|
|
"schemaVersion": 39,
|
|
"tags": [
|
|
"mikrosuricata",
|
|
"suricata",
|
|
"ids",
|
|
"prometheus",
|
|
"routeros",
|
|
"traffic",
|
|
"ndr"
|
|
],
|
|
"templating": {
|
|
"list": [
|
|
{
|
|
"current": {},
|
|
"hide": 0,
|
|
"includeAll": false,
|
|
"label": "Prometheus",
|
|
"multi": false,
|
|
"name": "datasource",
|
|
"options": [],
|
|
"query": "prometheus",
|
|
"refresh": 1,
|
|
"regex": "",
|
|
"skipUrlSync": false,
|
|
"type": "datasource"
|
|
},
|
|
{
|
|
"current": {},
|
|
"datasource": {
|
|
"type": "prometheus",
|
|
"uid": "${datasource}"
|
|
},
|
|
"definition": "label_values(mikrosuricata_build_info, instance)",
|
|
"hide": 0,
|
|
"includeAll": true,
|
|
"allValue": ".*",
|
|
"label": "Instance",
|
|
"multi": true,
|
|
"name": "instance",
|
|
"options": [],
|
|
"query": {
|
|
"query": "label_values(mikrosuricata_build_info, instance)",
|
|
"refId": "StandardVariableQuery"
|
|
},
|
|
"refresh": 1,
|
|
"regex": "",
|
|
"skipUrlSync": false,
|
|
"sort": 1,
|
|
"type": "query"
|
|
}
|
|
]
|
|
},
|
|
"time": {
|
|
"from": "now-6h",
|
|
"to": "now"
|
|
},
|
|
"timepicker": {},
|
|
"timezone": "browser",
|
|
"title": "MikroSuricata / Traffic & Security",
|
|
"uid": "mikrosuricata-prometheus",
|
|
"version": 2,
|
|
"weekStart": "monday",
|
|
"description": "Prometheus dashboard for MikroSuricata traffic throughput, packet pipeline, detection, response and sensor health."
|
|
}
|