627 lines
15 KiB
JSON
627 lines
15 KiB
JSON
{
|
|
"annotations": {
|
|
"list": [
|
|
{
|
|
"builtIn": 1,
|
|
"datasource": {
|
|
"type": "grafana",
|
|
"uid": "-- Grafana --"
|
|
},
|
|
"enable": true,
|
|
"hide": true,
|
|
"iconColor": "rgba(0, 211, 255, 1)",
|
|
"name": "Annotations & Alerts",
|
|
"type": "dashboard"
|
|
}
|
|
]
|
|
},
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 0,
|
|
"id": 2,
|
|
"links": [],
|
|
"panels": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"description": "This panel shows a time series graph of how many block events are occurring over time. Useful for spotting spikes that might indicate something is misconfigured or something is actively scanning your network.",
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisColorMode": "text",
|
|
"axisLabel": "Blocks/min",
|
|
"axisPlacement": "auto",
|
|
"barAlignment": 0,
|
|
"barWidthFactor": 0.6,
|
|
"drawStyle": "line",
|
|
"fillOpacity": 0,
|
|
"gradientMode": "none",
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
},
|
|
"insertNulls": false,
|
|
"lineInterpolation": "linear",
|
|
"lineWidth": 1,
|
|
"pointSize": 5,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"showPoints": "auto",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "none"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green"
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 0
|
|
},
|
|
"id": 2,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": false
|
|
},
|
|
"tooltip": {
|
|
"hideZeros": false,
|
|
"mode": "single",
|
|
"sort": "none"
|
|
}
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "sum(rate({job=\"unifi\"} |= \"DESCR=\" |= \"Drop All\" [1m]))",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Blocks Per Minute Over Time",
|
|
"type": "timeseries"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisColorMode": "text",
|
|
"axisLabel": "",
|
|
"axisPlacement": "auto",
|
|
"fillOpacity": 80,
|
|
"gradientMode": "none",
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
},
|
|
"lineWidth": 1,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green"
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 0
|
|
},
|
|
"id": 5,
|
|
"options": {
|
|
"barRadius": 0,
|
|
"barWidth": 0.97,
|
|
"fullHighlight": false,
|
|
"groupWidth": 0.7,
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"orientation": "auto",
|
|
"showValue": "auto",
|
|
"stacking": "none",
|
|
"tooltip": {
|
|
"hideZeros": false,
|
|
"mode": "single",
|
|
"sort": "none"
|
|
},
|
|
"xTickLabelRotation": 0,
|
|
"xTickLabelSpacing": 100
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "topk(10,\r\n sum by (dst_port) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"DPT=(?P<dst_port>\\\\d+)\"\r\n [$__range]\r\n )\r\n )\r\n)",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Blocked Traffic by Destination Port",
|
|
"type": "barchart"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"description": "This panel extracts the source IP from each block event and aggregates them into a table so you can see which devices are generating the most blocked traffic.",
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"custom": {
|
|
"align": "left",
|
|
"cellOptions": {
|
|
"type": "auto"
|
|
},
|
|
"filterable": false,
|
|
"inspect": false
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green"
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 6,
|
|
"x": 0,
|
|
"y": 8
|
|
},
|
|
"id": 4,
|
|
"options": {
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"countRows": false,
|
|
"enablePagination": false,
|
|
"fields": "",
|
|
"reducer": [
|
|
"sum"
|
|
],
|
|
"show": false
|
|
},
|
|
"frameIndex": 0,
|
|
"showHeader": false
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "topk(10,\r\n sum by (src_ip) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"SRC=(?P<src_ip>[\\\\d.]+)\"\r\n [$__range]\r\n )\r\n )\r\n)",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Top Blocked Source IPs",
|
|
"transformations": [
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true
|
|
},
|
|
"includeByName": {},
|
|
"indexByName": {},
|
|
"renameByName": {
|
|
"Time": "",
|
|
"src_ip": ""
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"id": "sortBy",
|
|
"options": {
|
|
"fields": {},
|
|
"sort": [
|
|
{
|
|
"desc": true,
|
|
"field": "Value #A"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"type": "table"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"custom": {
|
|
"align": "left",
|
|
"cellOptions": {
|
|
"type": "auto"
|
|
},
|
|
"inspect": false
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green"
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 6,
|
|
"x": 6,
|
|
"y": 8
|
|
},
|
|
"id": 6,
|
|
"options": {
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"countRows": false,
|
|
"fields": "",
|
|
"reducer": [
|
|
"sum"
|
|
],
|
|
"show": false
|
|
},
|
|
"showHeader": false
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "topk(10,\r\n sum by (dst_ip) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"DST=(?P<dst_ip>[\\\\d.]+)\"\r\n [$__range]\r\n )\r\n )\r\n)",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Top Blocked Destination IPs",
|
|
"transformations": [
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true
|
|
},
|
|
"includeByName": {},
|
|
"indexByName": {},
|
|
"renameByName": {}
|
|
}
|
|
},
|
|
{
|
|
"id": "sortBy",
|
|
"options": {
|
|
"fields": {},
|
|
"sort": [
|
|
{
|
|
"desc": true,
|
|
"field": "Value #A"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"type": "table"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"custom": {
|
|
"align": "left",
|
|
"cellOptions": {
|
|
"type": "auto"
|
|
},
|
|
"inspect": false
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green"
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 6,
|
|
"x": 12,
|
|
"y": 8
|
|
},
|
|
"id": 7,
|
|
"options": {
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"countRows": false,
|
|
"fields": "",
|
|
"reducer": [
|
|
"sum"
|
|
],
|
|
"show": false
|
|
},
|
|
"showHeader": true
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "topk(10,\r\n sum by (src_vlan, dst_vlan) (\r\n count_over_time(\r\n {job=\"unifi\"}\r\n |= \"DESCR=\" |= \"Drop All\"\r\n | regexp \"IN=(?P<src_vlan>\\\\S+)\\\\s+OUT=(?P<dst_vlan>\\\\S+)\"\r\n [$__range]\r\n )\r\n )\r\n)",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "VLAN-to-VLAN Block Matrix",
|
|
"transformations": [
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true
|
|
},
|
|
"includeByName": {},
|
|
"indexByName": {
|
|
"Time": 0,
|
|
"Value #A": 3,
|
|
"dst_vlan": 2,
|
|
"src_vlan": 1
|
|
},
|
|
"renameByName": {
|
|
"Value #A": "Total",
|
|
"dst_vlan": "Destination VLAN",
|
|
"src_vlan": "Source VLAN"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"id": "sortBy",
|
|
"options": {
|
|
"fields": {},
|
|
"sort": [
|
|
{
|
|
"desc": true,
|
|
"field": "Total"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"type": "table"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"description": "A simple stat panel showing the total block count for context.",
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green"
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 6,
|
|
"x": 18,
|
|
"y": 8
|
|
},
|
|
"id": 3,
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"percentChangeColorMode": "inverted",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showPercentChange": true,
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "sum(count_over_time({job=\"unifi\"} |= \"DESCR=\" |= \"Drop All\" [$__range]))",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Total Blocks",
|
|
"type": "stat"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 16
|
|
},
|
|
"id": 1,
|
|
"options": {
|
|
"dedupStrategy": "none",
|
|
"enableInfiniteScrolling": false,
|
|
"enableLogDetails": true,
|
|
"prettifyLogMessage": false,
|
|
"showCommonLabels": false,
|
|
"showLabels": false,
|
|
"showTime": true,
|
|
"sortOrder": "Descending",
|
|
"wrapLogMessage": false
|
|
},
|
|
"pluginVersion": "11.6.0",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"direction": "backward",
|
|
"editorMode": "code",
|
|
"expr": "{job=\"unifi\"} |= \"DESCR=\" |= \"Drop All\"",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Live Firewall Block Log",
|
|
"type": "logs"
|
|
}
|
|
],
|
|
"preload": false,
|
|
"schemaVersion": 41,
|
|
"tags": [],
|
|
"templating": {
|
|
"list": [
|
|
{
|
|
"baseFilters": [],
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "dfiqoqgt06arkc"
|
|
},
|
|
"filters": [],
|
|
"name": "Filters",
|
|
"type": "adhoc"
|
|
}
|
|
]
|
|
},
|
|
"time": {
|
|
"from": "now-1h",
|
|
"to": "now"
|
|
},
|
|
"timepicker": {},
|
|
"timezone": "browser",
|
|
"title": "Unifi - Internal Blocking",
|
|
"uid": "efixvpefee60wa",
|
|
"version": 15
|
|
} |