{ "annotations": { "list": [ { "builtIn": 1, "datasource": { "type": "grafana", "uid": "-- Grafana --" }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "type": "dashboard" } ] }, "editable": true, "fiscalYearStartMonth": 0, "graphTooltip": 0, "id": 2, "links": [], "panels": [ { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "description": "This panel shows a time series graph of how many block events are occurring over time. Useful for spotting spikes that might indicate something is misconfigured or something is actively scanning your network.", "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "Blocks/min", "axisPlacement": "auto", "barAlignment": 0, "barWidthFactor": 0.6, "drawStyle": "line", "fillOpacity": 0, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "insertNulls": false, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": { "type": "linear" }, "showPoints": "auto", "spanNulls": false, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green" }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 }, "id": 2, "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": false }, "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" } }, "pluginVersion": "11.6.0", "targets": [ { "direction": "backward", "editorMode": "code", "expr": "sum(rate({job=\"unifi\"} |= \"DESCR=\" |= \"Drop All\" [1m]))", "queryType": "range", "refId": "A" } ], "title": "Blocks Per Minute Over Time", "type": "timeseries" }, { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisBorderShow": false, "axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "fillOpacity": 80, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "lineWidth": 1, "scaleDistribution": { "type": "linear" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green" }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 }, "id": 5, "options": { "barRadius": 0, "barWidth": 0.97, "fullHighlight": false, "groupWidth": 0.7, "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true }, "orientation": "auto", "showValue": "auto", "stacking": "none", "tooltip": { "hideZeros": false, "mode": "single", "sort": "none" }, "xTickLabelRotation": 0, "xTickLabelSpacing": 100 }, "pluginVersion": "11.6.0", "targets": [ { "direction": "backward", "editorMode": "code", "expr": "topk(10,\r\n sum by (dst_port) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"DPT=(?P\\\\d+)\"\r\n [$__range]\r\n )\r\n )\r\n)", "queryType": "range", "refId": "A" } ], "title": "Blocked Traffic by Destination Port", "type": "barchart" }, { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "description": "This panel extracts the source IP from each block event and aggregates them into a table so you can see which devices are generating the most blocked traffic.", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "left", "cellOptions": { "type": "auto" }, "filterable": false, "inspect": false }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green" }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 8, "w": 6, "x": 0, "y": 8 }, "id": 4, "options": { "cellHeight": "sm", "footer": { "countRows": false, "enablePagination": false, "fields": "", "reducer": [ "sum" ], "show": false }, "frameIndex": 0, "showHeader": false }, "pluginVersion": "11.6.0", "targets": [ { "direction": "backward", "editorMode": "code", "expr": "topk(10,\r\n sum by (src_ip) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"SRC=(?P[\\\\d.]+)\"\r\n [$__range]\r\n )\r\n )\r\n)", "queryType": "instant", "refId": "A" } ], "title": "Top Blocked Source IPs", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true }, "includeByName": {}, "indexByName": {}, "renameByName": { "Time": "", "src_ip": "" } } }, { "id": "sortBy", "options": { "fields": {}, "sort": [ { "desc": true, "field": "Value #A" } ] } } ], "type": "table" }, { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "left", "cellOptions": { "type": "auto" }, "inspect": false }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green" }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 8, "w": 6, "x": 6, "y": 8 }, "id": 6, "options": { "cellHeight": "sm", "footer": { "countRows": false, "fields": "", "reducer": [ "sum" ], "show": false }, "showHeader": false }, "pluginVersion": "11.6.0", "targets": [ { "direction": "backward", "editorMode": "code", "expr": "topk(10,\r\n sum by (dst_ip) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"DST=(?P[\\\\d.]+)\"\r\n [$__range]\r\n )\r\n )\r\n)", "queryType": "instant", "refId": "A" } ], "title": "Top Blocked Destination IPs", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true }, "includeByName": {}, "indexByName": {}, "renameByName": {} } }, { "id": "sortBy", "options": { "fields": {}, "sort": [ { "desc": true, "field": "Value #A" } ] } } ], "type": "table" }, { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": "left", "cellOptions": { "type": "auto" }, "inspect": false }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green" }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 8, "w": 6, "x": 12, "y": 8 }, "id": 7, "options": { "cellHeight": "sm", "footer": { "countRows": false, "fields": "", "reducer": [ "sum" ], "show": false }, "showHeader": true }, "pluginVersion": "11.6.0", "targets": [ { "direction": "backward", "editorMode": "code", "expr": "topk(10,\r\n sum by (src_vlan, dst_vlan) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"IN=(?P\\\\S+)\\\\s+OUT=(?P\\\\S+)\"\r\n [$__range]\r\n )\r\n )\r\n)", "queryType": "instant", "refId": "A" } ], "title": "VLAN-to-VLAN Block Matrix", "transformations": [ { "id": "organize", "options": { "excludeByName": { "Time": true }, "includeByName": {}, "indexByName": { "Time": 0, "Value #A": 3, "dst_vlan": 2, "src_vlan": 1 }, "renameByName": { "Value #A": "Total", "dst_vlan": "Destination VLAN", "src_vlan": "Source VLAN" } } }, { "id": "sortBy", "options": { "fields": {}, "sort": [ { "desc": true, "field": "Total" } ] } } ], "type": "table" }, { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "description": "A simple stat panel showing the total block count for context.", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green" }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 8, "w": 6, "x": 18, "y": 8 }, "id": 3, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "percentChangeColorMode": "inverted", "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "showPercentChange": true, "textMode": "auto", "wideLayout": true }, "pluginVersion": "11.6.0", "targets": [ { "direction": "backward", "editorMode": "code", "expr": "sum(count_over_time({job=\"unifi\"} |= \"DESCR=\" |= \"Drop All\" [$__range]))", "queryType": "range", "refId": "A" } ], "title": "Total Blocks", "type": "stat" }, { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "fieldConfig": { "defaults": {}, "overrides": [] }, "gridPos": { "h": 10, "w": 24, "x": 0, "y": 16 }, "id": 1, "options": { "dedupStrategy": "none", "enableInfiniteScrolling": false, "enableLogDetails": true, "prettifyLogMessage": false, "showCommonLabels": false, "showLabels": false, "showTime": true, "sortOrder": "Descending", "wrapLogMessage": false }, "pluginVersion": "11.6.0", "targets": [ { "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "direction": "backward", "editorMode": "code", "expr": "{job=\"unifi\"} |= \"DESCR=\" |= \"Drop All\"", "queryType": "range", "refId": "A" } ], "title": "Live Firewall Block Log", "type": "logs" } ], "preload": false, "schemaVersion": 41, "tags": [], "templating": { "list": [ { "baseFilters": [], "datasource": { "type": "loki", "uid": "dfiqoqgt06arkc" }, "filters": [], "name": "Filters", "type": "adhoc" } ] }, "time": { "from": "now-1h", "to": "now" }, "timepicker": {}, "timezone": "browser", "title": "Unifi - Internal Blocking", "uid": "efixvpefee60wa", "version": 15 }