@cryptotaxi247 / CoPilot / commits / f1b5b49b

593 soincwall connector (#595)

* feat: Add SonicWall provisioning functionality - Implemented SonicWall provisioning service in `sonicwall.py` to handle index set creation, content pack provisioning, and Grafana datasource setup. - Created JSON templates for SonicWall input, processing pipeline, and stream configurations. - Developed a Vue component for SonicWall form input, allowing users to specify protocol, hot data retention, and index replicas. * fix: update graylog input name for SonicWall logs to include 'FIREWALL' and 'TLS' * precommit fixes * lint-fixes

taylor_socfortress committed Jan 13, 2026 at 16:15 UTC f1b5b49b9a7b69f91866eefa1448f044f60fa45e
24 files changed +14583 -101
backend/app/connectors/grafana/dashboards/Sonicwall/sonicwall_app_control.json new
+2542
@@ -0,0 +1,2542 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "grafana",
8 + "uid": "-- Grafana --"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "description": "SONICWALL - LOGS SUMMARY",
25 + "editable": false,
26 + "fiscalYearStartMonth": 0,
27 + "graphTooltip": 0,
28 + "id": null,
29 + "links": [
30 + {
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "SONICWALL"
37 + ],
38 + "targetBlank": true,
39 + "title": "SONICWALL DASHBOARDS",
40 + "tooltip": "",
41 + "type": "dashboards",
42 + "url": ""
43 + }
44 + ],
45 + "liveNow": false,
46 + "panels": [
47 + {
48 + "datasource": {
49 + "type": "grafana-opensearch-datasource",
50 + "uid": "replace_datasource_uid"
51 + },
52 + "fieldConfig": {
53 + "defaults": {
54 + "color": {
55 + "mode": "thresholds"
56 + },
57 + "mappings": [],
58 + "thresholds": {
59 + "mode": "absolute",
60 + "steps": [
61 + {
62 + "color": "orange",
63 + "value": null
64 + }
65 + ]
66 + },
67 + "unit": "short"
68 + },
69 + "overrides": []
70 + },
71 + "gridPos": {
72 + "h": 8,
73 + "w": 4,
74 + "x": 0,
75 + "y": 0
76 + },
77 + "id": 2,
78 + "options": {
79 + "colorMode": "value",
80 + "graphMode": "area",
81 + "justifyMode": "auto",
82 + "orientation": "auto",
83 + "reduceOptions": {
84 + "calcs": [
85 + "sum"
86 + ],
87 + "fields": "",
88 + "values": false
89 + },
90 + "showPercentChange": false,
91 + "textMode": "auto",
92 + "wideLayout": true
93 + },
94 + "pluginVersion": "10.4.1",
95 + "targets": [
96 + {
97 + "alias": "",
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto"
104 + },
105 + "type": "date_histogram"
106 + }
107 + ],
108 + "datasource": {
109 + "type": "grafana-opensearch-datasource",
110 + "uid": "replace_datasource_uid"
111 + },
112 + "metrics": [
113 + {
114 + "id": "1",
115 + "type": "count"
116 + }
117 + ],
118 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
119 + "refId": "A",
120 + "timeField": "timestamp"
121 + }
122 + ],
123 + "title": "APP CONTROL ALERTS",
124 + "type": "stat"
125 + },
126 + {
127 + "datasource": {
128 + "type": "grafana-opensearch-datasource",
129 + "uid": "replace_datasource_uid"
130 + },
131 + "fieldConfig": {
132 + "defaults": {
133 + "color": {
134 + "mode": "palette-classic"
135 + },
136 + "custom": {
137 + "hideFrom": {
138 + "legend": false,
139 + "tooltip": false,
140 + "viz": false
141 + }
142 + },
143 + "mappings": []
144 + },
145 + "overrides": []
146 + },
147 + "gridPos": {
148 + "h": 8,
149 + "w": 5,
150 + "x": 4,
151 + "y": 0
152 + },
153 + "id": 4,
154 + "options": {
155 + "legend": {
156 + "displayMode": "list",
157 + "placement": "right",
158 + "showLegend": false
159 + },
160 + "pieType": "pie",
161 + "reduceOptions": {
162 + "calcs": [
163 + "sum"
164 + ],
165 + "fields": "",
166 + "values": false
167 + },
168 + "tooltip": {
169 + "mode": "single",
170 + "sort": "none"
171 + }
172 + },
173 + "targets": [
174 + {
175 + "alias": "",
176 + "bucketAggs": [
177 + {
178 + "field": "fw",
179 + "id": "3",
180 + "settings": {
181 + "min_doc_count": "1",
182 + "order": "desc",
183 + "orderBy": "_count",
184 + "size": "15"
185 + },
186 + "type": "terms"
187 + },
188 + {
189 + "field": "timestamp",
190 + "id": "2",
191 + "settings": {
192 + "interval": "auto"
193 + },
194 + "type": "date_histogram"
195 + }
196 + ],
197 + "datasource": {
198 + "type": "grafana-opensearch-datasource",
199 + "uid": "replace_datasource_uid"
200 + },
201 + "metrics": [
202 + {
203 + "id": "1",
204 + "type": "count"
205 + }
206 + ],
207 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
208 + "refId": "A",
209 + "timeField": "timestamp"
210 + }
211 + ],
212 + "title": "ALERTS BY FIREWALL",
213 + "type": "piechart"
214 + },
215 + {
216 + "datasource": {
217 + "type": "grafana-opensearch-datasource",
218 + "uid": "replace_datasource_uid"
219 + },
220 + "fieldConfig": {
221 + "defaults": {
222 + "color": {
223 + "mode": "thresholds"
224 + },
225 + "custom": {
226 + "align": "auto",
227 + "cellOptions": {
228 + "type": "auto"
229 + },
230 + "inspect": false
231 + },
232 + "mappings": [],
233 + "thresholds": {
234 + "mode": "absolute",
235 + "steps": [
236 + {
237 + "color": "green",
238 + "value": null
239 + },
240 + {
241 + "color": "red",
242 + "value": 80
243 + }
244 + ]
245 + }
246 + },
247 + "overrides": [
248 + {
249 + "matcher": {
250 + "id": "byName",
251 + "options": "source"
252 + },
253 + "properties": [
254 + {
255 + "id": "custom.width",
256 + "value": 473
257 + }
258 + ]
259 + }
260 + ]
261 + },
262 + "gridPos": {
263 + "h": 8,
264 + "w": 7,
265 + "x": 9,
266 + "y": 0
267 + },
268 + "id": 5,
269 + "options": {
270 + "cellHeight": "sm",
271 + "footer": {
272 + "countRows": false,
273 + "fields": "",
274 + "reducer": [
275 + "sum"
276 + ],
277 + "show": false
278 + },
279 + "showHeader": true,
280 + "sortBy": []
281 + },
282 + "pluginVersion": "10.4.1",
283 + "targets": [
284 + {
285 + "alias": "",
286 + "bucketAggs": [
287 + {
288 + "field": "fw",
289 + "id": "3",
290 + "settings": {
291 + "min_doc_count": "1",
292 + "order": "desc",
293 + "orderBy": "_count",
294 + "size": "20"
295 + },
296 + "type": "terms"
297 + }
298 + ],
299 + "datasource": {
300 + "type": "grafana-opensearch-datasource",
301 + "uid": "replace_datasource_uid"
302 + },
303 + "metrics": [
304 + {
305 + "id": "1",
306 + "type": "count"
307 + }
308 + ],
309 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
310 + "refId": "A",
311 + "timeField": "timestamp"
312 + }
313 + ],
314 + "title": "LOGS BY FIREWALL",
315 + "transformations": [
316 + {
317 + "id": "organize",
318 + "options": {
319 + "excludeByName": {},
320 + "indexByName": {},
321 + "renameByName": {
322 + "devname": "FIREWALL",
323 + "fw": "FIREWALL"
324 + }
325 + }
326 + }
327 + ],
328 + "transparent": true,
329 + "type": "table"
330 + },
331 + {
332 + "datasource": {
333 + "type": "grafana-opensearch-datasource",
334 + "uid": "replace_datasource_uid"
335 + },
336 + "fieldConfig": {
337 + "defaults": {
338 + "color": {
339 + "mode": "palette-classic"
340 + },
341 + "custom": {
342 + "hideFrom": {
343 + "legend": false,
344 + "tooltip": false,
345 + "viz": false
346 + }
347 + },
348 + "mappings": []
349 + },
350 + "overrides": []
351 + },
352 + "gridPos": {
353 + "h": 8,
354 + "w": 8,
355 + "x": 16,
356 + "y": 0
357 + },
358 + "id": 18,
359 + "options": {
360 + "legend": {
361 + "displayMode": "table",
362 + "placement": "right",
363 + "showLegend": true
364 + },
365 + "pieType": "donut",
366 + "reduceOptions": {
367 + "calcs": [
368 + "sum"
369 + ],
370 + "fields": "",
371 + "values": false
372 + },
373 + "tooltip": {
374 + "mode": "single",
375 + "sort": "none"
376 + }
377 + },
378 + "targets": [
379 + {
380 + "alias": "",
381 + "bucketAggs": [
382 + {
383 + "field": "appcat",
384 + "id": "3",
385 + "settings": {
386 + "min_doc_count": "1",
387 + "order": "desc",
388 + "orderBy": "_count",
389 + "size": "10"
390 + },
391 + "type": "terms"
392 + },
393 + {
394 + "field": "timestamp",
395 + "id": "2",
396 + "settings": {
397 + "interval": "auto"
398 + },
399 + "type": "date_histogram"
400 + }
401 + ],
402 + "datasource": {
403 + "type": "grafana-opensearch-datasource",
404 + "uid": "replace_datasource_uid"
405 + },
406 + "metrics": [
407 + {
408 + "id": "1",
409 + "type": "count"
410 + }
411 + ],
412 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
413 + "refId": "A",
414 + "timeField": "timestamp"
415 + }
416 + ],
417 + "title": "ALERTS BY APP CAT (Top 10)",
418 + "type": "piechart"
419 + },
420 + {
421 + "datasource": {
422 + "type": "grafana-opensearch-datasource",
423 + "uid": "replace_datasource_uid"
424 + },
425 + "fieldConfig": {
426 + "defaults": {
427 + "color": {
428 + "mode": "thresholds"
429 + },
430 + "mappings": [],
431 + "thresholds": {
432 + "mode": "absolute",
433 + "steps": [
434 + {
435 + "color": "green",
436 + "value": null
437 + },
438 + {
439 + "color": "red",
440 + "value": 80
441 + }
442 + ]
443 + }
444 + },
445 + "overrides": []
446 + },
447 + "gridPos": {
448 + "h": 8,
449 + "w": 10,
450 + "x": 0,
451 + "y": 8
452 + },
453 + "id": 23,
454 + "options": {
455 + "displayMode": "gradient",
456 + "maxVizHeight": 300,
457 + "minVizHeight": 10,
458 + "minVizWidth": 0,
459 + "namePlacement": "auto",
460 + "orientation": "horizontal",
461 + "reduceOptions": {
462 + "calcs": [
463 + "sum"
464 + ],
465 + "fields": "",
466 + "values": false
467 + },
468 + "showUnfilled": true,
469 + "sizing": "auto",
470 + "valueMode": "color"
471 + },
472 + "pluginVersion": "10.4.1",
473 + "targets": [
474 + {
475 + "alias": "",
476 + "bucketAggs": [
477 + {
478 + "field": "dst_ip",
479 + "id": "4",
480 + "settings": {
481 + "min_doc_count": "1",
482 + "order": "desc",
483 + "orderBy": "_count",
484 + "size": "10"
485 + },
486 + "type": "terms"
487 + },
488 + {
489 + "field": "timestamp",
490 + "id": "2",
491 + "settings": {
492 + "interval": "auto"
493 + },
494 + "type": "date_histogram"
495 + }
496 + ],
497 + "datasource": {
498 + "type": "grafana-opensearch-datasource",
499 + "uid": "replace_datasource_uid"
500 + },
501 + "metrics": [
502 + {
503 + "id": "3",
504 + "type": "count"
505 + }
506 + ],
507 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
508 + "refId": "A",
509 + "timeField": "timestamp"
510 + }
511 + ],
512 + "title": "DST IP (Top 10)",
513 + "type": "bargauge"
514 + },
515 + {
516 + "datasource": {
517 + "type": "grafana-opensearch-datasource",
518 + "uid": "replace_datasource_uid"
519 + },
520 + "fieldConfig": {
521 + "defaults": {
522 + "color": {
523 + "mode": "thresholds"
524 + },
525 + "custom": {
526 + "hideFrom": {
527 + "legend": false,
528 + "tooltip": false,
529 + "viz": false
530 + }
531 + },
532 + "mappings": [],
533 + "thresholds": {
534 + "mode": "absolute",
535 + "steps": [
536 + {
537 + "color": "rgba(245, 54, 54, 0.9)",
538 + "value": null
539 + },
540 + {
541 + "color": "rgba(237, 129, 40, 0.89)",
542 + "value": 0
543 + },
544 + {
545 + "color": "rgba(50, 172, 45, 0.97)",
546 + "value": 10
547 + }
548 + ]
549 + }
550 + },
551 + "overrides": []
552 + },
553 + "gridPos": {
554 + "h": 8,
555 + "w": 8,
556 + "x": 10,
557 + "y": 8
558 + },
559 + "id": 20,
560 + "maxDataPoints": 1,
561 + "options": {
562 + "basemap": {
563 + "name": "Basemap",
564 + "type": "default"
565 + },
566 + "controls": {
567 + "mouseWheelZoom": false,
568 + "showAttribution": true,
569 + "showDebug": false,
570 + "showMeasure": false,
571 + "showScale": false,
572 + "showZoom": true
573 + },
574 + "layers": [
575 + {
576 + "config": {
577 + "showLegend": true,
578 + "style": {
579 + "color": {
580 + "fixed": "dark-green"
581 + },
582 + "opacity": 0.4,
583 + "rotation": {
584 + "fixed": 0,
585 + "max": 360,
586 + "min": -360,
587 + "mode": "mod"
588 + },
589 + "size": {
590 + "fixed": 5,
591 + "max": 30,
592 + "min": 2
593 + },
594 + "symbol": {
595 + "fixed": "img/icons/marker/circle.svg",
596 + "mode": "fixed"
597 + },
598 + "symbolAlign": {
599 + "horizontal": "center",
600 + "vertical": "center"
601 + },
602 + "textConfig": {
603 + "fontSize": 12,
604 + "offsetX": 0,
605 + "offsetY": 0,
606 + "textAlign": "center",
607 + "textBaseline": "middle"
608 + }
609 + }
610 + },
611 + "location": {
612 + "gazetteer": "public/gazetteer/countries.json",
613 + "mode": "lookup"
614 + },
615 + "name": "Layer 0",
616 + "tooltip": true,
617 + "type": "markers"
618 + }
619 + ],
620 + "tooltip": {
621 + "mode": "details"
622 + },
623 + "view": {
624 + "allLayers": true,
625 + "id": "zero",
626 + "lat": 0,
627 + "lon": 0,
628 + "zoom": 1
629 + }
630 + },
631 + "pluginVersion": "10.4.1",
632 + "targets": [
633 + {
634 + "bucketAggs": [
635 + {
636 + "fake": true,
637 + "field": "dst_ip_country_code",
638 + "id": "3",
639 + "settings": {
640 + "min_doc_count": 1,
641 + "order": "desc",
642 + "orderBy": "_count",
643 + "size": "20"
644 + },
645 + "type": "terms"
646 + },
647 + {
648 + "field": "timestamp",
649 + "id": "2",
650 + "settings": {
651 + "interval": "auto",
652 + "min_doc_count": 0,
653 + "trimEdges": 0
654 + },
655 + "type": "date_histogram"
656 + }
657 + ],
658 + "datasource": {
659 + "type": "grafana-opensearch-datasource",
660 + "uid": "replace_datasource_uid"
661 + },
662 + "metrics": [
663 + {
664 + "field": "select field",
665 + "id": "1",
666 + "type": "count"
667 + }
668 + ],
669 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
670 + "refId": "A",
671 + "timeField": "timestamp"
672 + }
673 + ],
674 + "title": "DST GEOIP",
675 + "transformations": [
676 + {
677 + "id": "reduce",
678 + "options": {
679 + "reducers": [
680 + "sum"
681 + ]
682 + }
683 + }
684 + ],
685 + "type": "geomap"
686 + },
687 + {
688 + "datasource": {
689 + "type": "grafana-opensearch-datasource",
690 + "uid": "replace_datasource_uid"
691 + },
692 + "fieldConfig": {
693 + "defaults": {
694 + "color": {
695 + "mode": "thresholds"
696 + },
697 + "custom": {
698 + "align": "auto",
699 + "cellOptions": {
700 + "type": "auto"
701 + },
702 + "inspect": false
703 + },
704 + "mappings": [],
705 + "thresholds": {
706 + "mode": "absolute",
707 + "steps": [
708 + {
709 + "color": "green",
710 + "value": null
711 + },
712 + {
713 + "color": "red",
714 + "value": 80
715 + }
716 + ]
717 + }
718 + },
719 + "overrides": [
720 + {
721 + "matcher": {
722 + "id": "byName",
723 + "options": "source"
724 + },
725 + "properties": [
726 + {
727 + "id": "custom.width",
728 + "value": 473
729 + }
730 + ]
731 + }
732 + ]
733 + },
734 + "gridPos": {
735 + "h": 8,
736 + "w": 6,
737 + "x": 18,
738 + "y": 8
739 + },
740 + "id": 24,
741 + "options": {
742 + "cellHeight": "sm",
743 + "footer": {
744 + "countRows": false,
745 + "fields": "",
746 + "reducer": [
747 + "sum"
748 + ],
749 + "show": false
750 + },
751 + "showHeader": true,
752 + "sortBy": []
753 + },
754 + "pluginVersion": "10.4.1",
755 + "targets": [
756 + {
757 + "alias": "",
758 + "bucketAggs": [
759 + {
760 + "field": "dst_ip",
761 + "id": "3",
762 + "settings": {
763 + "min_doc_count": "1",
764 + "order": "desc",
765 + "orderBy": "_count",
766 + "size": "20"
767 + },
768 + "type": "terms"
769 + },
770 + {
771 + "field": "dst_ip_country_code",
772 + "id": "4",
773 + "settings": {
774 + "min_doc_count": "1",
775 + "order": "desc",
776 + "orderBy": "_count",
777 + "size": "20"
778 + },
779 + "type": "terms"
780 + }
781 + ],
782 + "datasource": {
783 + "type": "grafana-opensearch-datasource",
784 + "uid": "replace_datasource_uid"
785 + },
786 + "metrics": [
787 + {
788 + "id": "1",
789 + "type": "count"
790 + }
791 + ],
792 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
793 + "refId": "A",
794 + "timeField": "timestamp"
795 + }
796 + ],
797 + "title": "DST IP AND COUNTRY",
798 + "transformations": [
799 + {
800 + "id": "organize",
801 + "options": {
802 + "excludeByName": {},
803 + "indexByName": {},
804 + "renameByName": {
805 + "devname": "FIREWALL",
806 + "fw": "FIREWALL"
807 + }
808 + }
809 + }
810 + ],
811 + "transparent": true,
812 + "type": "table"
813 + },
814 + {
815 + "datasource": {
816 + "type": "grafana-opensearch-datasource",
817 + "uid": "replace_datasource_uid"
818 + },
819 + "fieldConfig": {
820 + "defaults": {
821 + "color": {
822 + "mode": "thresholds"
823 + },
824 + "mappings": [],
825 + "thresholds": {
826 + "mode": "absolute",
827 + "steps": [
828 + {
829 + "color": "green",
830 + "value": null
831 + },
832 + {
833 + "color": "red",
834 + "value": 80
835 + }
836 + ]
837 + }
838 + },
839 + "overrides": []
840 + },
841 + "gridPos": {
842 + "h": 8,
843 + "w": 10,
844 + "x": 0,
845 + "y": 16
846 + },
847 + "id": 26,
848 + "options": {
849 + "displayMode": "gradient",
850 + "maxVizHeight": 300,
851 + "minVizHeight": 10,
852 + "minVizWidth": 0,
853 + "namePlacement": "auto",
854 + "orientation": "horizontal",
855 + "reduceOptions": {
856 + "calcs": [
857 + "sum"
858 + ],
859 + "fields": "",
860 + "values": false
861 + },
862 + "showUnfilled": true,
863 + "sizing": "auto",
864 + "valueMode": "color"
865 + },
866 + "pluginVersion": "10.4.1",
867 + "targets": [
868 + {
869 + "alias": "",
870 + "bucketAggs": [
871 + {
872 + "field": "src_ip",
873 + "id": "4",
874 + "settings": {
875 + "min_doc_count": "1",
876 + "order": "desc",
877 + "orderBy": "_count",
878 + "size": "10"
879 + },
880 + "type": "terms"
881 + },
882 + {
883 + "field": "timestamp",
884 + "id": "2",
885 + "settings": {
886 + "interval": "auto"
887 + },
888 + "type": "date_histogram"
889 + }
890 + ],
891 + "datasource": {
892 + "type": "grafana-opensearch-datasource",
893 + "uid": "replace_datasource_uid"
894 + },
895 + "metrics": [
896 + {
897 + "id": "3",
898 + "type": "count"
899 + }
900 + ],
901 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
902 + "refId": "A",
903 + "timeField": "timestamp"
904 + }
905 + ],
906 + "title": "SRC IP (Top 10)",
907 + "type": "bargauge"
908 + },
909 + {
910 + "datasource": {
911 + "type": "grafana-opensearch-datasource",
912 + "uid": "replace_datasource_uid"
913 + },
914 + "fieldConfig": {
915 + "defaults": {
916 + "color": {
917 + "mode": "thresholds"
918 + },
919 + "custom": {
920 + "hideFrom": {
921 + "legend": false,
922 + "tooltip": false,
923 + "viz": false
924 + }
925 + },
926 + "mappings": [],
927 + "thresholds": {
928 + "mode": "absolute",
929 + "steps": [
930 + {
931 + "color": "rgba(245, 54, 54, 0.9)",
932 + "value": null
933 + },
934 + {
935 + "color": "rgba(237, 129, 40, 0.89)",
936 + "value": 0
937 + },
938 + {
939 + "color": "rgba(50, 172, 45, 0.97)",
940 + "value": 10
941 + }
942 + ]
943 + }
944 + },
945 + "overrides": []
946 + },
947 + "gridPos": {
948 + "h": 8,
949 + "w": 8,
950 + "x": 10,
951 + "y": 16
952 + },
953 + "id": 21,
954 + "maxDataPoints": 1,
955 + "options": {
956 + "basemap": {
957 + "name": "Basemap",
958 + "type": "default"
959 + },
960 + "controls": {
961 + "mouseWheelZoom": false,
962 + "showAttribution": true,
963 + "showDebug": false,
964 + "showMeasure": false,
965 + "showScale": false,
966 + "showZoom": true
967 + },
968 + "layers": [
969 + {
970 + "config": {
971 + "showLegend": true,
972 + "style": {
973 + "color": {
974 + "fixed": "dark-green"
975 + },
976 + "opacity": 0.4,
977 + "rotation": {
978 + "fixed": 0,
979 + "max": 360,
980 + "min": -360,
981 + "mode": "mod"
982 + },
983 + "size": {
984 + "fixed": 5,
985 + "max": 30,
986 + "min": 2
987 + },
988 + "symbol": {
989 + "fixed": "img/icons/marker/circle.svg",
990 + "mode": "fixed"
991 + },
992 + "symbolAlign": {
993 + "horizontal": "center",
994 + "vertical": "center"
995 + },
996 + "textConfig": {
997 + "fontSize": 12,
998 + "offsetX": 0,
999 + "offsetY": 0,
1000 + "textAlign": "center",
1001 + "textBaseline": "middle"
1002 + }
1003 + }
1004 + },
1005 + "location": {
1006 + "gazetteer": "public/gazetteer/countries.json",
1007 + "mode": "lookup"
1008 + },
1009 + "name": "Layer 0",
1010 + "tooltip": true,
1011 + "type": "markers"
1012 + }
1013 + ],
1014 + "tooltip": {
1015 + "mode": "details"
1016 + },
1017 + "view": {
1018 + "allLayers": true,
1019 + "id": "zero",
1020 + "lat": 0,
1021 + "lon": 0,
1022 + "zoom": 1
1023 + }
1024 + },
1025 + "pluginVersion": "10.4.1",
1026 + "targets": [
1027 + {
1028 + "bucketAggs": [
1029 + {
1030 + "fake": true,
1031 + "field": "src_ip_country_code",
1032 + "id": "3",
1033 + "settings": {
1034 + "min_doc_count": 1,
1035 + "order": "desc",
1036 + "orderBy": "_term",
1037 + "size": "0"
1038 + },
1039 + "type": "terms"
1040 + },
1041 + {
1042 + "field": "timestamp",
1043 + "id": "2",
1044 + "settings": {
1045 + "interval": "auto",
1046 + "min_doc_count": 0,
1047 + "trimEdges": 0
1048 + },
1049 + "type": "date_histogram"
1050 + }
1051 + ],
1052 + "datasource": {
1053 + "type": "grafana-opensearch-datasource",
1054 + "uid": "replace_datasource_uid"
1055 + },
1056 + "metrics": [
1057 + {
1058 + "field": "select field",
1059 + "id": "1",
1060 + "type": "count"
1061 + }
1062 + ],
1063 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
1064 + "refId": "A",
1065 + "timeField": "timestamp"
1066 + }
1067 + ],
1068 + "title": "SRC GEOIP",
1069 + "transformations": [
1070 + {
1071 + "id": "reduce",
1072 + "options": {
1073 + "reducers": [
1074 + "sum"
1075 + ]
1076 + }
1077 + }
1078 + ],
1079 + "type": "geomap"
1080 + },
1081 + {
1082 + "datasource": {
1083 + "type": "grafana-opensearch-datasource",
1084 + "uid": "replace_datasource_uid"
1085 + },
1086 + "fieldConfig": {
1087 + "defaults": {
1088 + "color": {
1089 + "mode": "thresholds"
1090 + },
1091 + "custom": {
1092 + "align": "auto",
1093 + "cellOptions": {
1094 + "type": "auto"
1095 + },
1096 + "inspect": false
1097 + },
1098 + "mappings": [],
1099 + "thresholds": {
1100 + "mode": "absolute",
1101 + "steps": [
1102 + {
1103 + "color": "green",
1104 + "value": null
1105 + },
1106 + {
1107 + "color": "red",
1108 + "value": 80
1109 + }
1110 + ]
1111 + }
1112 + },
1113 + "overrides": [
1114 + {
1115 + "matcher": {
1116 + "id": "byName",
1117 + "options": "source"
1118 + },
1119 + "properties": [
1120 + {
1121 + "id": "custom.width",
1122 + "value": 473
1123 + }
1124 + ]
1125 + }
1126 + ]
1127 + },
1128 + "gridPos": {
1129 + "h": 8,
1130 + "w": 6,
1131 + "x": 18,
1132 + "y": 16
1133 + },
1134 + "id": 25,
1135 + "options": {
1136 + "cellHeight": "sm",
1137 + "footer": {
1138 + "countRows": false,
1139 + "fields": "",
1140 + "reducer": [
1141 + "sum"
1142 + ],
1143 + "show": false
1144 + },
1145 + "showHeader": true,
1146 + "sortBy": []
1147 + },
1148 + "pluginVersion": "10.4.1",
1149 + "targets": [
1150 + {
1151 + "alias": "",
1152 + "bucketAggs": [
1153 + {
1154 + "field": "src_ip",
1155 + "id": "3",
1156 + "settings": {
1157 + "min_doc_count": "1",
1158 + "order": "desc",
1159 + "orderBy": "_count",
1160 + "size": "20"
1161 + },
1162 + "type": "terms"
1163 + },
1164 + {
1165 + "field": "src_ip_country_code",
1166 + "id": "4",
1167 + "settings": {
1168 + "min_doc_count": "1",
1169 + "order": "desc",
1170 + "orderBy": "_count",
1171 + "size": "20"
1172 + },
1173 + "type": "terms"
1174 + }
1175 + ],
1176 + "datasource": {
1177 + "type": "grafana-opensearch-datasource",
1178 + "uid": "replace_datasource_uid"
1179 + },
1180 + "metrics": [
1181 + {
1182 + "id": "1",
1183 + "type": "count"
1184 + }
1185 + ],
1186 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
1187 + "refId": "A",
1188 + "timeField": "timestamp"
1189 + }
1190 + ],
1191 + "title": "SRC IP AND COUNTRY",
1192 + "transformations": [
1193 + {
1194 + "id": "organize",
1195 + "options": {
1196 + "excludeByName": {},
1197 + "indexByName": {},
1198 + "renameByName": {
1199 + "devname": "FIREWALL",
1200 + "fw": "FIREWALL"
1201 + }
1202 + }
1203 + }
1204 + ],
1205 + "transparent": true,
1206 + "type": "table"
1207 + },
1208 + {
1209 + "datasource": {
1210 + "type": "grafana-opensearch-datasource",
1211 + "uid": "replace_datasource_uid"
1212 + },
1213 + "fieldConfig": {
1214 + "defaults": {
1215 + "color": {
1216 + "mode": "palette-classic"
1217 + },
1218 + "custom": {
1219 + "hideFrom": {
1220 + "legend": false,
1221 + "tooltip": false,
1222 + "viz": false
1223 + }
1224 + },
1225 + "mappings": []
1226 + },
1227 + "overrides": [
1228 + {
1229 + "matcher": {
1230 + "id": "byName",
1231 + "options": "INFO"
1232 + },
1233 + "properties": [
1234 + {
1235 + "id": "color",
1236 + "value": {
1237 + "fixedColor": "blue",
1238 + "mode": "fixed"
1239 + }
1240 + }
1241 + ]
1242 + },
1243 + {
1244 + "matcher": {
1245 + "id": "byName",
1246 + "options": "Alert"
1247 + },
1248 + "properties": [
1249 + {
1250 + "id": "color",
1251 + "value": {
1252 + "fixedColor": "light-red",
1253 + "mode": "fixed"
1254 + }
1255 + }
1256 + ]
1257 + },
1258 + {
1259 + "matcher": {
1260 + "id": "byName",
1261 + "options": "Notice"
1262 + },
1263 + "properties": [
1264 + {
1265 + "id": "color",
1266 + "value": {
1267 + "fixedColor": "light-blue",
1268 + "mode": "fixed"
1269 + }
1270 + }
1271 + ]
1272 + },
1273 + {
1274 + "matcher": {
1275 + "id": "byName",
1276 + "options": "Warning"
1277 + },
1278 + "properties": [
1279 + {
1280 + "id": "color",
1281 + "value": {
1282 + "fixedColor": "orange",
1283 + "mode": "fixed"
1284 + }
1285 + }
1286 + ]
1287 + }
1288 + ]
1289 + },
1290 + "gridPos": {
1291 + "h": 8,
1292 + "w": 6,
1293 + "x": 0,
1294 + "y": 24
1295 + },
1296 + "id": 8,
1297 + "options": {
1298 + "legend": {
1299 + "displayMode": "table",
1300 + "placement": "right",
1301 + "showLegend": true
1302 + },
1303 + "pieType": "donut",
1304 + "reduceOptions": {
1305 + "calcs": [
1306 + "sum"
1307 + ],
1308 + "fields": "",
1309 + "values": false
1310 + },
1311 + "tooltip": {
1312 + "mode": "single",
1313 + "sort": "none"
1314 + }
1315 + },
1316 + "targets": [
1317 + {
1318 + "alias": "",
1319 + "bucketAggs": [
1320 + {
1321 + "field": "syslog_level",
1322 + "id": "3",
1323 + "settings": {
1324 + "min_doc_count": "1",
1325 + "order": "desc",
1326 + "orderBy": "_count",
1327 + "size": "15"
1328 + },
1329 + "type": "terms"
1330 + },
1331 + {
1332 + "field": "timestamp",
1333 + "id": "2",
1334 + "settings": {
1335 + "interval": "auto"
1336 + },
1337 + "type": "date_histogram"
1338 + }
1339 + ],
1340 + "datasource": {
1341 + "type": "grafana-opensearch-datasource",
1342 + "uid": "replace_datasource_uid"
1343 + },
1344 + "metrics": [
1345 + {
1346 + "id": "1",
1347 + "type": "count"
1348 + }
1349 + ],
1350 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
1351 + "refId": "A",
1352 + "timeField": "timestamp"
1353 + }
1354 + ],
1355 + "title": "LOGS BY SEVERITY",
1356 + "type": "piechart"
1357 + },
1358 + {
1359 + "datasource": {
1360 + "type": "grafana-opensearch-datasource",
1361 + "uid": "replace_datasource_uid"
1362 + },
1363 + "fieldConfig": {
1364 + "defaults": {
1365 + "color": {
1366 + "mode": "palette-classic"
1367 + },
1368 + "custom": {
1369 + "axisBorderShow": false,
1370 + "axisCenteredZero": false,
1371 + "axisColorMode": "text",
1372 + "axisLabel": "",
1373 + "axisPlacement": "auto",
1374 + "barAlignment": 0,
1375 + "drawStyle": "bars",
1376 + "fillOpacity": 0,
1377 + "gradientMode": "none",
1378 + "hideFrom": {
1379 + "legend": false,
1380 + "tooltip": false,
1381 + "viz": false
1382 + },
1383 + "insertNulls": false,
1384 + "lineInterpolation": "linear",
1385 + "lineWidth": 1,
1386 + "pointSize": 5,
1387 + "scaleDistribution": {
1388 + "type": "linear"
1389 + },
1390 + "showPoints": "auto",
1391 + "spanNulls": false,
1392 + "stacking": {
1393 + "group": "A",
1394 + "mode": "none"
1395 + },
1396 + "thresholdsStyle": {
1397 + "mode": "off"
1398 + }
1399 + },
1400 + "mappings": [],
1401 + "thresholds": {
1402 + "mode": "absolute",
1403 + "steps": [
1404 + {
1405 + "color": "green",
1406 + "value": null
1407 + },
1408 + {
1409 + "color": "red",
1410 + "value": 80
1411 + }
1412 + ]
1413 + },
1414 + "unit": "short"
1415 + },
1416 + "overrides": []
1417 + },
1418 + "gridPos": {
1419 + "h": 16,
1420 + "w": 18,
1421 + "x": 6,
1422 + "y": 24
1423 + },
1424 + "id": 7,
1425 + "options": {
1426 + "legend": {
1427 + "calcs": [],
1428 + "displayMode": "table",
1429 + "placement": "right",
1430 + "showLegend": true
1431 + },
1432 + "tooltip": {
1433 + "mode": "single",
1434 + "sort": "none"
1435 + }
1436 + },
1437 + "pluginVersion": "8.5.1",
1438 + "targets": [
1439 + {
1440 + "alias": "",
1441 + "bucketAggs": [
1442 + {
1443 + "field": "fw",
1444 + "id": "3",
1445 + "settings": {
1446 + "min_doc_count": "1",
1447 + "order": "desc",
1448 + "orderBy": "_count",
1449 + "size": "20"
1450 + },
1451 + "type": "terms"
1452 + },
1453 + {
1454 + "field": "timestamp",
1455 + "id": "4",
1456 + "settings": {
1457 + "interval": "5m",
1458 + "min_doc_count": "1",
1459 + "timeZone": "utc",
1460 + "trimEdges": "0"
1461 + },
1462 + "type": "date_histogram"
1463 + }
1464 + ],
1465 + "datasource": {
1466 + "type": "grafana-opensearch-datasource",
1467 + "uid": "replace_datasource_uid"
1468 + },
1469 + "metrics": [
1470 + {
1471 + "id": "1",
1472 + "type": "count"
1473 + }
1474 + ],
1475 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
1476 + "refId": "A",
1477 + "timeField": "timestamp"
1478 + }
1479 + ],
1480 + "title": "LOGS BY FIREWALL - HISTOGRAM (TOP 20)",
1481 + "type": "timeseries"
1482 + },
1483 + {
1484 + "datasource": {
1485 + "type": "grafana-opensearch-datasource",
1486 + "uid": "replace_datasource_uid"
1487 + },
1488 + "fieldConfig": {
1489 + "defaults": {
1490 + "color": {
1491 + "mode": "palette-classic"
1492 + },
1493 + "custom": {
1494 + "hideFrom": {
1495 + "legend": false,
1496 + "tooltip": false,
1497 + "viz": false
1498 + }
1499 + },
1500 + "mappings": []
1501 + },
1502 + "overrides": [
1503 + {
1504 + "matcher": {
1505 + "id": "byName",
1506 + "options": "information"
1507 + },
1508 + "properties": [
1509 + {
1510 + "id": "color",
1511 + "value": {
1512 + "fixedColor": "blue",
1513 + "mode": "fixed"
1514 + }
1515 + }
1516 + ]
1517 + },
1518 + {
1519 + "matcher": {
1520 + "id": "byName",
1521 + "options": "notice"
1522 + },
1523 + "properties": [
1524 + {
1525 + "id": "color",
1526 + "value": {
1527 + "fixedColor": "green",
1528 + "mode": "fixed"
1529 + }
1530 + }
1531 + ]
1532 + },
1533 + {
1534 + "matcher": {
1535 + "id": "byName",
1536 + "options": "warning"
1537 + },
1538 + "properties": [
1539 + {
1540 + "id": "color",
1541 + "value": {
1542 + "fixedColor": "orange",
1543 + "mode": "fixed"
1544 + }
1545 + }
1546 + ]
1547 + },
1548 + {
1549 + "matcher": {
1550 + "id": "byName",
1551 + "options": "alert"
1552 + },
1553 + "properties": [
1554 + {
1555 + "id": "color",
1556 + "value": {
1557 + "fixedColor": "red",
1558 + "mode": "fixed"
1559 + }
1560 + }
1561 + ]
1562 + },
1563 + {
1564 + "matcher": {
1565 + "id": "byName",
1566 + "options": "block-url"
1567 + },
1568 + "properties": [
1569 + {
1570 + "id": "color",
1571 + "value": {
1572 + "fixedColor": "orange",
1573 + "mode": "fixed"
1574 + }
1575 + }
1576 + ]
1577 + },
1578 + {
1579 + "matcher": {
1580 + "id": "byName",
1581 + "options": "passthrough"
1582 + },
1583 + "properties": [
1584 + {
1585 + "id": "color",
1586 + "value": {
1587 + "fixedColor": "green",
1588 + "mode": "fixed"
1589 + }
1590 + }
1591 + ]
1592 + },
1593 + {
1594 + "matcher": {
1595 + "id": "byName",
1596 + "options": "NA"
1597 + },
1598 + "properties": [
1599 + {
1600 + "id": "color",
1601 + "value": {
1602 + "fixedColor": "orange",
1603 + "mode": "fixed"
1604 + }
1605 + }
1606 + ]
1607 + },
1608 + {
1609 + "matcher": {
1610 + "id": "byName",
1611 + "options": "drop"
1612 + },
1613 + "properties": [
1614 + {
1615 + "id": "color",
1616 + "value": {
1617 + "fixedColor": "red",
1618 + "mode": "fixed"
1619 + }
1620 + }
1621 + ]
1622 + },
1623 + {
1624 + "matcher": {
1625 + "id": "byName",
1626 + "options": "forward"
1627 + },
1628 + "properties": [
1629 + {
1630 + "id": "color",
1631 + "value": {
1632 + "fixedColor": "green",
1633 + "mode": "fixed"
1634 + }
1635 + }
1636 + ]
1637 + },
1638 + {
1639 + "matcher": {
1640 + "id": "byName",
1641 + "options": "mgmt"
1642 + },
1643 + "properties": [
1644 + {
1645 + "id": "color",
1646 + "value": {
1647 + "fixedColor": "blue",
1648 + "mode": "fixed"
1649 + }
1650 + }
1651 + ]
1652 + }
1653 + ]
1654 + },
1655 + "gridPos": {
1656 + "h": 8,
1657 + "w": 6,
1658 + "x": 0,
1659 + "y": 32
1660 + },
1661 + "id": 12,
1662 + "options": {
1663 + "legend": {
1664 + "displayMode": "table",
1665 + "placement": "right",
1666 + "showLegend": true
1667 + },
1668 + "pieType": "donut",
1669 + "reduceOptions": {
1670 + "calcs": [
1671 + "sum"
1672 + ],
1673 + "fields": "",
1674 + "values": false
1675 + },
1676 + "tooltip": {
1677 + "mode": "single",
1678 + "sort": "none"
1679 + }
1680 + },
1681 + "targets": [
1682 + {
1683 + "alias": "",
1684 + "bucketAggs": [
1685 + {
1686 + "field": "fw_action",
1687 + "id": "3",
1688 + "settings": {
1689 + "min_doc_count": "1",
1690 + "order": "desc",
1691 + "orderBy": "_count",
1692 + "size": "15"
1693 + },
1694 + "type": "terms"
1695 + },
1696 + {
1697 + "field": "timestamp",
1698 + "id": "2",
1699 + "settings": {
1700 + "interval": "auto"
1701 + },
1702 + "type": "date_histogram"
1703 + }
1704 + ],
1705 + "datasource": {
1706 + "type": "grafana-opensearch-datasource",
1707 + "uid": "replace_datasource_uid"
1708 + },
1709 + "metrics": [
1710 + {
1711 + "id": "1",
1712 + "type": "count"
1713 + }
1714 + ],
1715 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
1716 + "refId": "A",
1717 + "timeField": "timestamp"
1718 + }
1719 + ],
1720 + "title": "TRAFFIC LOGS BY ACTION",
1721 + "type": "piechart"
1722 + },
1723 + {
1724 + "datasource": {
1725 + "type": "grafana-opensearch-datasource",
1726 + "uid": "replace_datasource_uid"
1727 + },
1728 + "fieldConfig": {
1729 + "defaults": {
1730 + "color": {
1731 + "mode": "palette-classic"
1732 + },
1733 + "custom": {
1734 + "hideFrom": {
1735 + "legend": false,
1736 + "tooltip": false,
1737 + "viz": false
1738 + }
1739 + },
1740 + "mappings": []
1741 + },
1742 + "overrides": []
1743 + },
1744 + "gridPos": {
1745 + "h": 8,
1746 + "w": 6,
1747 + "x": 0,
1748 + "y": 40
1749 + },
1750 + "id": 17,
1751 + "options": {
1752 + "legend": {
1753 + "displayMode": "list",
1754 + "placement": "right",
1755 + "showLegend": false
1756 + },
1757 + "pieType": "pie",
1758 + "reduceOptions": {
1759 + "calcs": [
1760 + "sum"
1761 + ],
1762 + "fields": "",
1763 + "values": false
1764 + },
1765 + "tooltip": {
1766 + "mode": "single",
1767 + "sort": "none"
1768 + }
1769 + },
1770 + "targets": [
1771 + {
1772 + "alias": "",
1773 + "bucketAggs": [
1774 + {
1775 + "field": "msg_cat",
1776 + "id": "3",
1777 + "settings": {
1778 + "min_doc_count": "1",
1779 + "order": "desc",
1780 + "orderBy": "_count",
1781 + "size": "15"
1782 + },
1783 + "type": "terms"
1784 + },
1785 + {
1786 + "field": "timestamp",
1787 + "id": "2",
1788 + "settings": {
1789 + "interval": "auto"
1790 + },
1791 + "type": "date_histogram"
1792 + }
1793 + ],
1794 + "datasource": {
1795 + "type": "grafana-opensearch-datasource",
1796 + "uid": "replace_datasource_uid"
1797 + },
1798 + "metrics": [
1799 + {
1800 + "id": "1",
1801 + "type": "count"
1802 + }
1803 + ],
1804 + "query": "fw:$firewall",
1805 + "refId": "A",
1806 + "timeField": "timestamp"
1807 + }
1808 + ],
1809 + "title": "LOGS BY NSG CAT (Top 15)",
1810 + "type": "piechart"
1811 + },
1812 + {
1813 + "datasource": {
1814 + "type": "grafana-opensearch-datasource",
1815 + "uid": "replace_datasource_uid"
1816 + },
1817 + "fieldConfig": {
1818 + "defaults": {
1819 + "color": {
1820 + "mode": "thresholds"
1821 + },
1822 + "custom": {
1823 + "align": "auto",
1824 + "cellOptions": {
1825 + "type": "auto"
1826 + },
1827 + "inspect": false
1828 + },
1829 + "mappings": [],
1830 + "thresholds": {
1831 + "mode": "absolute",
1832 + "steps": [
1833 + {
1834 + "color": "green"
1835 + },
1836 + {
1837 + "color": "red",
1838 + "value": 80
1839 + }
1840 + ]
1841 + }
1842 + },
1843 + "overrides": [
1844 + {
1845 + "matcher": {
1846 + "id": "byName",
1847 + "options": "source"
1848 + },
1849 + "properties": [
1850 + {
1851 + "id": "custom.width",
1852 + "value": 473
1853 + }
1854 + ]
1855 + },
1856 + {
1857 + "matcher": {
1858 + "id": "byName",
1859 + "options": "USER ACCOUNT"
1860 + },
1861 + "properties": [
1862 + {
1863 + "id": "custom.width",
1864 + "value": 422
1865 + }
1866 + ]
1867 + },
1868 + {
1869 + "matcher": {
1870 + "id": "byName",
1871 + "options": "INDICATOR"
1872 + },
1873 + "properties": [
1874 + {
1875 + "id": "custom.width",
1876 + "value": 439
1877 + }
1878 + ]
1879 + },
1880 + {
1881 + "matcher": {
1882 + "id": "byName",
1883 + "options": "msg_detail"
1884 + },
1885 + "properties": [
1886 + {
1887 + "id": "custom.width",
1888 + "value": 796
1889 + }
1890 + ]
1891 + }
1892 + ]
1893 + },
1894 + "gridPos": {
1895 + "h": 8,
1896 + "w": 18,
1897 + "x": 6,
1898 + "y": 40
1899 + },
1900 + "id": 14,
1901 + "options": {
1902 + "cellHeight": "sm",
1903 + "footer": {
1904 + "countRows": false,
1905 + "fields": "",
1906 + "reducer": [
1907 + "sum"
1908 + ],
1909 + "show": false
1910 + },
1911 + "showHeader": true,
1912 + "sortBy": []
1913 + },
1914 + "pluginVersion": "10.4.1",
1915 + "targets": [
1916 + {
1917 + "alias": "",
1918 + "bucketAggs": [
1919 + {
1920 + "field": "msg_detail",
1921 + "id": "3",
1922 + "settings": {
1923 + "min_doc_count": "1",
1924 + "order": "desc",
1925 + "orderBy": "_count",
1926 + "size": "0"
1927 + },
1928 + "type": "terms"
1929 + }
1930 + ],
1931 + "datasource": {
1932 + "type": "grafana-opensearch-datasource",
1933 + "uid": "replace_datasource_uid"
1934 + },
1935 + "metrics": [
1936 + {
1937 + "id": "1",
1938 + "type": "count"
1939 + }
1940 + ],
1941 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
1942 + "refId": "A",
1943 + "timeField": "timestamp"
1944 + }
1945 + ],
1946 + "title": "LOGS BY MSG DETAIL",
1947 + "transformations": [
1948 + {
1949 + "id": "organize",
1950 + "options": {
1951 + "excludeByName": {},
1952 + "indexByName": {},
1953 + "renameByName": {
1954 + "msg": "INDICATOR",
1955 + "msg_cat": "MSG CATEGORY",
1956 + "user": "USER ACCOUNT"
1957 + }
1958 + }
1959 + }
1960 + ],
1961 + "transparent": true,
1962 + "type": "table"
1963 + },
1964 + {
1965 + "datasource": {
1966 + "type": "grafana-opensearch-datasource",
1967 + "uid": "replace_datasource_uid"
1968 + },
1969 + "fieldConfig": {
1970 + "defaults": {
1971 + "color": {
1972 + "mode": "thresholds"
1973 + },
1974 + "custom": {
1975 + "align": "auto",
1976 + "cellOptions": {
1977 + "type": "auto"
1978 + },
1979 + "inspect": false
1980 + },
1981 + "mappings": [],
1982 + "thresholds": {
1983 + "mode": "absolute",
1984 + "steps": [
1985 + {
1986 + "color": "green"
1987 + },
1988 + {
1989 + "color": "red",
1990 + "value": 80
1991 + }
1992 + ]
1993 + }
1994 + },
1995 + "overrides": [
1996 + {
1997 + "matcher": {
1998 + "id": "byName",
1999 + "options": "FIREWALL"
2000 + },
2001 + "properties": [
2002 + {
2003 + "id": "custom.width",
2004 + "value": 149
2005 + }
2006 + ]
2007 + },
2008 + {
2009 + "matcher": {
2010 + "id": "byName",
2011 + "options": "ACTION"
2012 + },
2013 + "properties": [
2014 + {
2015 + "id": "custom.width",
2016 + "value": 105
2017 + }
2018 + ]
2019 + },
2020 + {
2021 + "matcher": {
2022 + "id": "byName",
2023 + "options": "SEVERITY"
2024 + },
2025 + "properties": [
2026 + {
2027 + "id": "custom.width",
2028 + "value": 109
2029 + },
2030 + {
2031 + "id": "custom.cellOptions",
2032 + "value": {
2033 + "type": "color-text"
2034 + }
2035 + },
2036 + {
2037 + "id": "mappings",
2038 + "value": [
2039 + {
2040 + "options": {
2041 + "Alert": {
2042 + "color": "red",
2043 + "index": 3
2044 + },
2045 + "Critical": {
2046 + "color": "dark-red",
2047 + "index": 4
2048 + },
2049 + "Emergency": {
2050 + "color": "purple",
2051 + "index": 6
2052 + },
2053 + "Error": {
2054 + "color": "red",
2055 + "index": 5
2056 + },
2057 + "Info": {
2058 + "color": "green",
2059 + "index": 1
2060 + },
2061 + "Notice": {
2062 + "color": "blue",
2063 + "index": 0
2064 + },
2065 + "Warning": {
2066 + "color": "orange",
2067 + "index": 2
2068 + }
2069 + },
2070 + "type": "value"
2071 + }
2072 + ]
2073 + }
2074 + ]
2075 + },
2076 + {
2077 + "matcher": {
2078 + "id": "byName",
2079 + "options": "SRC IP"
2080 + },
2081 + "properties": [
2082 + {
2083 + "id": "custom.width",
2084 + "value": 137
2085 + }
2086 + ]
2087 + },
2088 + {
2089 + "matcher": {
2090 + "id": "byName",
2091 + "options": "SRC PORT"
2092 + },
2093 + "properties": [
2094 + {
2095 + "id": "custom.width",
2096 + "value": 87
2097 + }
2098 + ]
2099 + },
2100 + {
2101 + "matcher": {
2102 + "id": "byName",
2103 + "options": "IF IN"
2104 + },
2105 + "properties": [
2106 + {
2107 + "id": "custom.width",
2108 + "value": 110
2109 + }
2110 + ]
2111 + },
2112 + {
2113 + "matcher": {
2114 + "id": "byName",
2115 + "options": "APP"
2116 + },
2117 + "properties": [
2118 + {
2119 + "id": "custom.width",
2120 + "value": 131
2121 + }
2122 + ]
2123 + },
2124 + {
2125 + "matcher": {
2126 + "id": "byName",
2127 + "options": "DST IP"
2128 + },
2129 + "properties": [
2130 + {
2131 + "id": "custom.width",
2132 + "value": 134
2133 + }
2134 + ]
2135 + },
2136 + {
2137 + "matcher": {
2138 + "id": "byName",
2139 + "options": "DST PORT"
2140 + },
2141 + "properties": [
2142 + {
2143 + "id": "custom.width",
2144 + "value": 93
2145 + }
2146 + ]
2147 + },
2148 + {
2149 + "matcher": {
2150 + "id": "byName",
2151 + "options": "EVENT ID"
2152 + },
2153 + "properties": [
2154 + {
2155 + "id": "links",
2156 + "value": [
2157 + {
2158 + "targetBlank": true,
2159 + "title": "EVENT DETAILS",
2160 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SONICWALL%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D"
2161 + }
2162 + ]
2163 + },
2164 + {
2165 + "id": "custom.width",
2166 + "value": 214
2167 + }
2168 + ]
2169 + },
2170 + {
2171 + "matcher": {
2172 + "id": "byName",
2173 + "options": "SERVICE"
2174 + },
2175 + "properties": [
2176 + {
2177 + "id": "custom.width",
2178 + "value": 95
2179 + }
2180 + ]
2181 + },
2182 + {
2183 + "matcher": {
2184 + "id": "byName",
2185 + "options": "DATE/TIME"
2186 + },
2187 + "properties": [
2188 + {
2189 + "id": "custom.width",
2190 + "value": 188
2191 + }
2192 + ]
2193 + },
2194 + {
2195 + "matcher": {
2196 + "id": "byName",
2197 + "options": "PROFILE"
2198 + },
2199 + "properties": [
2200 + {
2201 + "id": "custom.width",
2202 + "value": 234
2203 + }
2204 + ]
2205 + },
2206 + {
2207 + "matcher": {
2208 + "id": "byName",
2209 + "options": "SRC IF"
2210 + },
2211 + "properties": [
2212 + {
2213 + "id": "custom.width",
2214 + "value": 74
2215 + }
2216 + ]
2217 + },
2218 + {
2219 + "matcher": {
2220 + "id": "byName",
2221 + "options": "PROTO"
2222 + },
2223 + "properties": [
2224 + {
2225 + "id": "custom.width",
2226 + "value": 117
2227 + }
2228 + ]
2229 + },
2230 + {
2231 + "matcher": {
2232 + "id": "byName",
2233 + "options": "DST IF"
2234 + },
2235 + "properties": [
2236 + {
2237 + "id": "custom.width",
2238 + "value": 95
2239 + }
2240 + ]
2241 + }
2242 + ]
2243 + },
2244 + "gridPos": {
2245 + "h": 15,
2246 + "w": 24,
2247 + "x": 0,
2248 + "y": 48
2249 + },
2250 + "id": 16,
2251 + "options": {
2252 + "cellHeight": "sm",
2253 + "footer": {
2254 + "countRows": false,
2255 + "fields": "",
2256 + "reducer": [
2257 + "sum"
2258 + ],
2259 + "show": false
2260 + },
2261 + "showHeader": true,
2262 + "sortBy": []
2263 + },
2264 + "pluginVersion": "10.4.1",
2265 + "targets": [
2266 + {
2267 + "alias": "",
2268 + "bucketAggs": [],
2269 + "datasource": {
2270 + "type": "grafana-opensearch-datasource",
2271 + "uid": "replace_datasource_uid"
2272 + },
2273 + "metrics": [
2274 + {
2275 + "id": "1",
2276 + "settings": {
2277 + "size": "500"
2278 + },
2279 + "type": "raw_data"
2280 + }
2281 + ],
2282 + "query": "fw:$firewall AND msg_cat:\"Application Control Detection Alert\"",
2283 + "refId": "A",
2284 + "timeField": "timestamp"
2285 + }
2286 + ],
2287 + "title": "FIREWALL EVENTS",
2288 + "transformations": [
2289 + {
2290 + "id": "organize",
2291 + "options": {
2292 + "excludeByName": {
2293 + "_index": true,
2294 + "_type": true,
2295 + "alert_category": true,
2296 + "alert_definitions_version": true,
2297 + "alertlight": true,
2298 + "app": true,
2299 + "appid": true,
2300 + "c": true,
2301 + "cat": true,
2302 + "catdesc": true,
2303 + "category": true,
2304 + "catid": true,
2305 + "craction": true,
2306 + "crlevel": true,
2307 + "crscore": true,
2308 + "devid": true,
2309 + "direction": true,
2310 + "dst": true,
2311 + "dstMAC": true,
2312 + "dstMac": true,
2313 + "dst_host": true,
2314 + "dst_ip_city_name": true,
2315 + "dst_ip_country_code": true,
2316 + "dst_ip_geolocation": true,
2317 + "dstintf": true,
2318 + "dstintfrole": true,
2319 + "dstip": true,
2320 + "dstip_city_name": true,
2321 + "dstip_country_code": true,
2322 + "dstip_geolocation": true,
2323 + "dstport": true,
2324 + "eventtype": true,
2325 + "facility": true,
2326 + "facility_num": true,
2327 + "fw_city_name": true,
2328 + "fw_country_code": true,
2329 + "fw_geolocation": true,
2330 + "gl2_accounted_message_size": true,
2331 + "gl2_message_id": true,
2332 + "gl2_remote_ip": true,
2333 + "gl2_remote_port": true,
2334 + "gl2_source_input": true,
2335 + "gl2_source_node": true,
2336 + "group": true,
2337 + "highlight": true,
2338 + "hostname": true,
2339 + "hostname_city_name": true,
2340 + "hostname_country_code": true,
2341 + "hostname_geolocation": true,
2342 + "id": true,
2343 + "level": true,
2344 + "logdesc": false,
2345 + "logver": true,
2346 + "m": true,
2347 + "message": true,
2348 + "method": true,
2349 + "msg": false,
2350 + "msg_cat": true,
2351 + "msg_detail": false,
2352 + "n": true,
2353 + "note": true,
2354 + "policyid": true,
2355 + "pri": true,
2356 + "proto": false,
2357 + "rcvdbyte": true,
2358 + "reqtype": true,
2359 + "rule": true,
2360 + "sentbyte": true,
2361 + "sessionid": true,
2362 + "sid": true,
2363 + "sn": true,
2364 + "sort": true,
2365 + "source": true,
2366 + "source_city_name": true,
2367 + "source_country_code": true,
2368 + "source_geolocation": true,
2369 + "src": true,
2370 + "srcMac": true,
2371 + "src_ip_city_name": true,
2372 + "src_ip_country_code": true,
2373 + "src_ip_geolocation": true,
2374 + "srcintf": true,
2375 + "srcintfrole": true,
2376 + "srcip": true,
2377 + "srcip_city_name": true,
2378 + "srcip_country_code": true,
2379 + "srcip_geolocation": true,
2380 + "srcport": true,
2381 + "streams": true,
2382 + "subtype": false,
2383 + "syslog_level": true,
2384 + "syslog_type": true,
2385 + "time": true,
2386 + "type": true,
2387 + "user": true,
2388 + "vd": true
2389 + },
2390 + "indexByName": {
2391 + "_id": 1,
2392 + "_index": 7,
2393 + "_type": 8,
2394 + "appid": 18,
2395 + "catid": 19,
2396 + "dst": 20,
2397 + "dstMAC": 21,
2398 + "dst_host": 22,
2399 + "dst_if": 26,
2400 + "dst_ip": 23,
2401 + "dst_ip_city_name": 27,
2402 + "dst_ip_country_code": 28,
2403 + "dst_ip_geolocation": 29,
2404 + "dst_port": 24,
2405 + "facility": 30,
2406 + "facility_num": 31,
2407 + "fw": 2,
2408 + "fw_action": 32,
2409 + "fw_city_name": 33,
2410 + "fw_country_code": 34,
2411 + "fw_geolocation": 35,
2412 + "gl2_accounted_message_size": 9,
2413 + "gl2_message_id": 10,
2414 + "gl2_remote_ip": 11,
2415 + "gl2_remote_port": 12,
2416 + "gl2_source_input": 13,
2417 + "gl2_source_node": 14,
2418 + "highlight": 36,
2419 + "id": 37,
2420 + "level": 38,
2421 + "message": 15,
2422 + "msg": 39,
2423 + "proto": 25,
2424 + "rule": 40,
2425 + "sid": 41,
2426 + "sn": 42,
2427 + "sort": 43,
2428 + "source": 6,
2429 + "source_city_name": 44,
2430 + "source_country_code": 45,
2431 + "source_geolocation": 46,
2432 + "src": 47,
2433 + "srcMac": 48,
2434 + "src_if": 5,
2435 + "src_ip": 3,
2436 + "src_ip_city_name": 49,
2437 + "src_ip_country_code": 50,
2438 + "src_ip_geolocation": 51,
2439 + "src_port": 4,
2440 + "streams": 16,
2441 + "syslog_type": 17,
2442 + "timestamp": 0
2443 + },
2444 + "renameByName": {
2445 + "_id": "EVENT ID",
2446 + "action": "ACTION",
2447 + "alert_signature": "SIGNATURE",
2448 + "app": "APP",
2449 + "appcat": "APP CAT",
2450 + "destination_location_name": "LOCATION",
2451 + "devname": "FIREWALL",
2452 + "dst_if": "DST IF",
2453 + "dst_ip": "DST IP",
2454 + "dst_port": "DST PORT",
2455 + "dstip": "DST IP",
2456 + "dstport": "DST PORT",
2457 + "event_log_name": "",
2458 + "fw": "FIREWALL",
2459 + "fw_action": "ACTION",
2460 + "http_method": "METHOD",
2461 + "http_user_agent_name": "HTTP AGENT",
2462 + "logdesc": "DESCRIPTION",
2463 + "msg": "MESSAGE",
2464 + "msg_detail": "MSG DETAIL",
2465 + "network_interface_in": "IF IN",
2466 + "network_interface_out": "IF OUT",
2467 + "network_transport": "",
2468 + "profile": "PROFILE",
2469 + "proto": "PROTO",
2470 + "rule_name": "RULE",
2471 + "service": "SERVICE",
2472 + "source": "",
2473 + "source_port": "SRC PORT",
2474 + "src_if": "SRC IF",
2475 + "src_ip": "SRC IP",
2476 + "src_port": "SRC PORT",
2477 + "srcip": "SRC IP",
2478 + "subtype": "SUBTYPE",
2479 + "syslog_level": "SEVERITY",
2480 + "timestamp": "DATE/TIME",
2481 + "url": "URL"
2482 + }
2483 + }
2484 + }
2485 + ],
2486 + "transparent": true,
2487 + "type": "table"
2488 + }
2489 + ],
2490 + "schemaVersion": 39,
2491 + "tags": [
2492 + "SONICWALL"
2493 + ],
2494 + "templating": {
2495 + "list": [
2496 + {
2497 + "current": {
2498 + "selected": false,
2499 + "text": "All",
2500 + "value": "$__all"
2501 + },
2502 + "datasource": {
2503 + "type": "grafana-opensearch-datasource",
2504 + "uid": "replace_datasource_uid"
2505 + },
2506 + "definition": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"msg_cat:\\\"Application Control Detection Alert\\\"\"}",
2507 + "description": "FORTINET FIREWALL",
2508 + "hide": 0,
2509 + "includeAll": true,
2510 + "label": "Firewall",
2511 + "multi": false,
2512 + "name": "firewall",
2513 + "options": [],
2514 + "query": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"msg_cat:\\\"Application Control Detection Alert\\\"\"}",
2515 + "refresh": 1,
2516 + "regex": "",
2517 + "skipUrlSync": false,
2518 + "sort": 0,
2519 + "type": "query"
2520 + },
2521 + {
2522 + "datasource": {
2523 + "type": "grafana-opensearch-datasource",
2524 + "uid": "replace_datasource_uid"
2525 + },
2526 + "filters": [],
2527 + "hide": 0,
2528 + "name": "Filters",
2529 + "skipUrlSync": false,
2530 + "type": "adhoc"
2531 + }
2532 + ]
2533 + },
2534 + "time": {
2535 + "from": "now-6h",
2536 + "to": "now"
2537 + },
2538 + "timepicker": {},
2539 + "timezone": "",
2540 + "title": "SONICWALL - APP CONTROL",
2541 + "weekStart": ""
2542 +}
backend/app/connectors/grafana/dashboards/Sonicwall/sonicwall_ips.json new
+2449
@@ -0,0 +1,2449 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "grafana",
8 + "uid": "-- Grafana --"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "description": "SONICWALL - LOGS SUMMARY",
25 + "editable": false,
26 + "fiscalYearStartMonth": 0,
27 + "graphTooltip": 0,
28 + "id": null,
29 + "links": [
30 + {
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "SONICWALL"
37 + ],
38 + "targetBlank": true,
39 + "title": "SONICWALL DASHBOARDS",
40 + "tooltip": "",
41 + "type": "dashboards",
42 + "url": ""
43 + }
44 + ],
45 + "liveNow": false,
46 + "panels": [
47 + {
48 + "datasource": {
49 + "type": "grafana-opensearch-datasource",
50 + "uid": "replace_datasource_uid"
51 + },
52 + "fieldConfig": {
53 + "defaults": {
54 + "color": {
55 + "mode": "thresholds"
56 + },
57 + "mappings": [],
58 + "thresholds": {
59 + "mode": "absolute",
60 + "steps": [
61 + {
62 + "color": "orange",
63 + "value": null
64 + }
65 + ]
66 + },
67 + "unit": "short"
68 + },
69 + "overrides": []
70 + },
71 + "gridPos": {
72 + "h": 8,
73 + "w": 4,
74 + "x": 0,
75 + "y": 0
76 + },
77 + "id": 2,
78 + "options": {
79 + "colorMode": "value",
80 + "graphMode": "area",
81 + "justifyMode": "auto",
82 + "orientation": "auto",
83 + "reduceOptions": {
84 + "calcs": [
85 + "sum"
86 + ],
87 + "fields": "",
88 + "values": false
89 + },
90 + "showPercentChange": false,
91 + "textMode": "auto",
92 + "wideLayout": true
93 + },
94 + "pluginVersion": "10.4.1",
95 + "targets": [
96 + {
97 + "alias": "",
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto"
104 + },
105 + "type": "date_histogram"
106 + }
107 + ],
108 + "datasource": {
109 + "type": "grafana-opensearch-datasource",
110 + "uid": "replace_datasource_uid"
111 + },
112 + "metrics": [
113 + {
114 + "id": "1",
115 + "type": "count"
116 + }
117 + ],
118 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
119 + "refId": "A",
120 + "timeField": "timestamp"
121 + }
122 + ],
123 + "title": "IPS ALERTS",
124 + "type": "stat"
125 + },
126 + {
127 + "datasource": {
128 + "type": "grafana-opensearch-datasource",
129 + "uid": "replace_datasource_uid"
130 + },
131 + "fieldConfig": {
132 + "defaults": {
133 + "color": {
134 + "mode": "palette-classic"
135 + },
136 + "custom": {
137 + "hideFrom": {
138 + "legend": false,
139 + "tooltip": false,
140 + "viz": false
141 + }
142 + },
143 + "mappings": []
144 + },
145 + "overrides": []
146 + },
147 + "gridPos": {
148 + "h": 8,
149 + "w": 5,
150 + "x": 4,
151 + "y": 0
152 + },
153 + "id": 4,
154 + "options": {
155 + "legend": {
156 + "displayMode": "list",
157 + "placement": "right",
158 + "showLegend": false
159 + },
160 + "pieType": "pie",
161 + "reduceOptions": {
162 + "calcs": [
163 + "sum"
164 + ],
165 + "fields": "",
166 + "values": false
167 + },
168 + "tooltip": {
169 + "mode": "single",
170 + "sort": "none"
171 + }
172 + },
173 + "targets": [
174 + {
175 + "alias": "",
176 + "bucketAggs": [
177 + {
178 + "field": "fw",
179 + "id": "3",
180 + "settings": {
181 + "min_doc_count": "1",
182 + "order": "desc",
183 + "orderBy": "_count",
184 + "size": "15"
185 + },
186 + "type": "terms"
187 + },
188 + {
189 + "field": "timestamp",
190 + "id": "2",
191 + "settings": {
192 + "interval": "auto"
193 + },
194 + "type": "date_histogram"
195 + }
196 + ],
197 + "datasource": {
198 + "type": "grafana-opensearch-datasource",
199 + "uid": "replace_datasource_uid"
200 + },
201 + "metrics": [
202 + {
203 + "id": "1",
204 + "type": "count"
205 + }
206 + ],
207 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
208 + "refId": "A",
209 + "timeField": "timestamp"
210 + }
211 + ],
212 + "title": "ALERTS BY FIREWALL",
213 + "type": "piechart"
214 + },
215 + {
216 + "datasource": {
217 + "type": "grafana-opensearch-datasource",
218 + "uid": "replace_datasource_uid"
219 + },
220 + "fieldConfig": {
221 + "defaults": {
222 + "color": {
223 + "mode": "thresholds"
224 + },
225 + "custom": {
226 + "align": "auto",
227 + "cellOptions": {
228 + "type": "auto"
229 + },
230 + "inspect": false
231 + },
232 + "mappings": [],
233 + "thresholds": {
234 + "mode": "absolute",
235 + "steps": [
236 + {
237 + "color": "green",
238 + "value": null
239 + },
240 + {
241 + "color": "red",
242 + "value": 80
243 + }
244 + ]
245 + }
246 + },
247 + "overrides": [
248 + {
249 + "matcher": {
250 + "id": "byName",
251 + "options": "source"
252 + },
253 + "properties": [
254 + {
255 + "id": "custom.width",
256 + "value": 473
257 + }
258 + ]
259 + }
260 + ]
261 + },
262 + "gridPos": {
263 + "h": 8,
264 + "w": 10,
265 + "x": 9,
266 + "y": 0
267 + },
268 + "id": 5,
269 + "options": {
270 + "cellHeight": "sm",
271 + "footer": {
272 + "countRows": false,
273 + "fields": "",
274 + "reducer": [
275 + "sum"
276 + ],
277 + "show": false
278 + },
279 + "showHeader": true,
280 + "sortBy": []
281 + },
282 + "pluginVersion": "10.4.1",
283 + "targets": [
284 + {
285 + "alias": "",
286 + "bucketAggs": [
287 + {
288 + "field": "fw",
289 + "id": "3",
290 + "settings": {
291 + "min_doc_count": "1",
292 + "order": "desc",
293 + "orderBy": "_count",
294 + "size": "20"
295 + },
296 + "type": "terms"
297 + }
298 + ],
299 + "datasource": {
300 + "type": "grafana-opensearch-datasource",
301 + "uid": "replace_datasource_uid"
302 + },
303 + "metrics": [
304 + {
305 + "id": "1",
306 + "type": "count"
307 + }
308 + ],
309 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
310 + "refId": "A",
311 + "timeField": "timestamp"
312 + }
313 + ],
314 + "title": "LOGS BY FIREWALL",
315 + "transformations": [
316 + {
317 + "id": "organize",
318 + "options": {
319 + "excludeByName": {},
320 + "indexByName": {},
321 + "renameByName": {
322 + "devname": "FIREWALL",
323 + "fw": "FIREWALL"
324 + }
325 + }
326 + }
327 + ],
328 + "transparent": true,
329 + "type": "table"
330 + },
331 + {
332 + "datasource": {
333 + "type": "grafana-opensearch-datasource",
334 + "uid": "replace_datasource_uid"
335 + },
336 + "fieldConfig": {
337 + "defaults": {
338 + "color": {
339 + "mode": "thresholds"
340 + },
341 + "mappings": [],
342 + "thresholds": {
343 + "mode": "absolute",
344 + "steps": [
345 + {
346 + "color": "green",
347 + "value": null
348 + },
349 + {
350 + "color": "red",
351 + "value": 80
352 + }
353 + ]
354 + }
355 + },
356 + "overrides": []
357 + },
358 + "gridPos": {
359 + "h": 8,
360 + "w": 10,
361 + "x": 0,
362 + "y": 8
363 + },
364 + "id": 23,
365 + "options": {
366 + "displayMode": "gradient",
367 + "maxVizHeight": 300,
368 + "minVizHeight": 10,
369 + "minVizWidth": 0,
370 + "namePlacement": "auto",
371 + "orientation": "horizontal",
372 + "reduceOptions": {
373 + "calcs": [
374 + "sum"
375 + ],
376 + "fields": "",
377 + "values": false
378 + },
379 + "showUnfilled": true,
380 + "sizing": "auto",
381 + "valueMode": "color"
382 + },
383 + "pluginVersion": "10.4.1",
384 + "targets": [
385 + {
386 + "alias": "",
387 + "bucketAggs": [
388 + {
389 + "field": "dst_ip",
390 + "id": "4",
391 + "settings": {
392 + "min_doc_count": "1",
393 + "order": "desc",
394 + "orderBy": "_count",
395 + "size": "10"
396 + },
397 + "type": "terms"
398 + },
399 + {
400 + "field": "timestamp",
401 + "id": "2",
402 + "settings": {
403 + "interval": "auto"
404 + },
405 + "type": "date_histogram"
406 + }
407 + ],
408 + "datasource": {
409 + "type": "grafana-opensearch-datasource",
410 + "uid": "replace_datasource_uid"
411 + },
412 + "metrics": [
413 + {
414 + "id": "3",
415 + "type": "count"
416 + }
417 + ],
418 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
419 + "refId": "A",
420 + "timeField": "timestamp"
421 + }
422 + ],
423 + "title": "DST IP (Top 10)",
424 + "type": "bargauge"
425 + },
426 + {
427 + "datasource": {
428 + "type": "grafana-opensearch-datasource",
429 + "uid": "replace_datasource_uid"
430 + },
431 + "fieldConfig": {
432 + "defaults": {
433 + "color": {
434 + "mode": "thresholds"
435 + },
436 + "custom": {
437 + "hideFrom": {
438 + "legend": false,
439 + "tooltip": false,
440 + "viz": false
441 + }
442 + },
443 + "mappings": [],
444 + "thresholds": {
445 + "mode": "absolute",
446 + "steps": [
447 + {
448 + "color": "rgba(245, 54, 54, 0.9)",
449 + "value": null
450 + },
451 + {
452 + "color": "rgba(237, 129, 40, 0.89)",
453 + "value": 0
454 + },
455 + {
456 + "color": "rgba(50, 172, 45, 0.97)",
457 + "value": 10
458 + }
459 + ]
460 + }
461 + },
462 + "overrides": []
463 + },
464 + "gridPos": {
465 + "h": 8,
466 + "w": 8,
467 + "x": 10,
468 + "y": 8
469 + },
470 + "id": 20,
471 + "maxDataPoints": 1,
472 + "options": {
473 + "basemap": {
474 + "name": "Basemap",
475 + "type": "default"
476 + },
477 + "controls": {
478 + "mouseWheelZoom": false,
479 + "showAttribution": true,
480 + "showDebug": false,
481 + "showMeasure": false,
482 + "showScale": false,
483 + "showZoom": true
484 + },
485 + "layers": [
486 + {
487 + "config": {
488 + "showLegend": true,
489 + "style": {
490 + "color": {
491 + "fixed": "dark-green"
492 + },
493 + "opacity": 0.4,
494 + "rotation": {
495 + "fixed": 0,
496 + "max": 360,
497 + "min": -360,
498 + "mode": "mod"
499 + },
500 + "size": {
501 + "fixed": 5,
502 + "max": 30,
503 + "min": 2
504 + },
505 + "symbol": {
506 + "fixed": "img/icons/marker/circle.svg",
507 + "mode": "fixed"
508 + },
509 + "symbolAlign": {
510 + "horizontal": "center",
511 + "vertical": "center"
512 + },
513 + "textConfig": {
514 + "fontSize": 12,
515 + "offsetX": 0,
516 + "offsetY": 0,
517 + "textAlign": "center",
518 + "textBaseline": "middle"
519 + }
520 + }
521 + },
522 + "location": {
523 + "gazetteer": "public/gazetteer/countries.json",
524 + "mode": "lookup"
525 + },
526 + "name": "Layer 0",
527 + "tooltip": true,
528 + "type": "markers"
529 + }
530 + ],
531 + "tooltip": {
532 + "mode": "details"
533 + },
534 + "view": {
535 + "allLayers": true,
536 + "id": "zero",
537 + "lat": 0,
538 + "lon": 0,
539 + "zoom": 1
540 + }
541 + },
542 + "pluginVersion": "10.4.1",
543 + "targets": [
544 + {
545 + "bucketAggs": [
546 + {
547 + "fake": true,
548 + "field": "dst_ip_country_code",
549 + "id": "3",
550 + "settings": {
551 + "min_doc_count": 1,
552 + "order": "desc",
553 + "orderBy": "_term",
554 + "size": "0"
555 + },
556 + "type": "terms"
557 + },
558 + {
559 + "field": "timestamp",
560 + "id": "2",
561 + "settings": {
562 + "interval": "auto",
563 + "min_doc_count": 0,
564 + "trimEdges": 0
565 + },
566 + "type": "date_histogram"
567 + }
568 + ],
569 + "datasource": {
570 + "type": "grafana-opensearch-datasource",
571 + "uid": "replace_datasource_uid"
572 + },
573 + "metrics": [
574 + {
575 + "field": "select field",
576 + "id": "1",
577 + "type": "count"
578 + }
579 + ],
580 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
581 + "refId": "A",
582 + "timeField": "timestamp"
583 + }
584 + ],
585 + "title": "DST GEOIP",
586 + "transformations": [
587 + {
588 + "id": "reduce",
589 + "options": {
590 + "reducers": [
591 + "sum"
592 + ]
593 + }
594 + }
595 + ],
596 + "type": "geomap"
597 + },
598 + {
599 + "datasource": {
600 + "type": "grafana-opensearch-datasource",
601 + "uid": "replace_datasource_uid"
602 + },
603 + "fieldConfig": {
604 + "defaults": {
605 + "color": {
606 + "mode": "thresholds"
607 + },
608 + "custom": {
609 + "align": "auto",
610 + "cellOptions": {
611 + "type": "auto"
612 + },
613 + "inspect": false
614 + },
615 + "mappings": [],
616 + "thresholds": {
617 + "mode": "absolute",
618 + "steps": [
619 + {
620 + "color": "green",
621 + "value": null
622 + },
623 + {
624 + "color": "red",
625 + "value": 80
626 + }
627 + ]
628 + }
629 + },
630 + "overrides": [
631 + {
632 + "matcher": {
633 + "id": "byName",
634 + "options": "source"
635 + },
636 + "properties": [
637 + {
638 + "id": "custom.width",
639 + "value": 473
640 + }
641 + ]
642 + }
643 + ]
644 + },
645 + "gridPos": {
646 + "h": 8,
647 + "w": 6,
648 + "x": 18,
649 + "y": 8
650 + },
651 + "id": 25,
652 + "options": {
653 + "cellHeight": "sm",
654 + "footer": {
655 + "countRows": false,
656 + "fields": "",
657 + "reducer": [
658 + "sum"
659 + ],
660 + "show": false
661 + },
662 + "showHeader": true,
663 + "sortBy": []
664 + },
665 + "pluginVersion": "10.4.1",
666 + "targets": [
667 + {
668 + "alias": "",
669 + "bucketAggs": [
670 + {
671 + "field": "dst_ip",
672 + "id": "3",
673 + "settings": {
674 + "min_doc_count": "1",
675 + "order": "desc",
676 + "orderBy": "_count",
677 + "size": "20"
678 + },
679 + "type": "terms"
680 + },
681 + {
682 + "field": "dst_ip_country_code",
683 + "id": "4",
684 + "settings": {
685 + "min_doc_count": "1",
686 + "order": "desc",
687 + "orderBy": "_count",
688 + "size": "20"
689 + },
690 + "type": "terms"
691 + }
692 + ],
693 + "datasource": {
694 + "type": "grafana-opensearch-datasource",
695 + "uid": "replace_datasource_uid"
696 + },
697 + "metrics": [
698 + {
699 + "id": "1",
700 + "type": "count"
701 + }
702 + ],
703 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
704 + "refId": "A",
705 + "timeField": "timestamp"
706 + }
707 + ],
708 + "title": "DST IP AND COUNTRY",
709 + "transformations": [
710 + {
711 + "id": "organize",
712 + "options": {
713 + "excludeByName": {},
714 + "indexByName": {},
715 + "renameByName": {
716 + "devname": "FIREWALL",
717 + "fw": "FIREWALL"
718 + }
719 + }
720 + }
721 + ],
722 + "transparent": true,
723 + "type": "table"
724 + },
725 + {
726 + "datasource": {
727 + "type": "grafana-opensearch-datasource",
728 + "uid": "replace_datasource_uid"
729 + },
730 + "fieldConfig": {
731 + "defaults": {
732 + "color": {
733 + "mode": "thresholds"
734 + },
735 + "mappings": [],
736 + "thresholds": {
737 + "mode": "absolute",
738 + "steps": [
739 + {
740 + "color": "green",
741 + "value": null
742 + },
743 + {
744 + "color": "red",
745 + "value": 80
746 + }
747 + ]
748 + }
749 + },
750 + "overrides": []
751 + },
752 + "gridPos": {
753 + "h": 8,
754 + "w": 10,
755 + "x": 0,
756 + "y": 16
757 + },
758 + "id": 26,
759 + "options": {
760 + "displayMode": "gradient",
761 + "maxVizHeight": 300,
762 + "minVizHeight": 10,
763 + "minVizWidth": 0,
764 + "namePlacement": "auto",
765 + "orientation": "horizontal",
766 + "reduceOptions": {
767 + "calcs": [
768 + "sum"
769 + ],
770 + "fields": "",
771 + "values": false
772 + },
773 + "showUnfilled": true,
774 + "sizing": "auto",
775 + "valueMode": "color"
776 + },
777 + "pluginVersion": "10.4.1",
778 + "targets": [
779 + {
780 + "alias": "",
781 + "bucketAggs": [
782 + {
783 + "field": "src_ip",
784 + "id": "4",
785 + "settings": {
786 + "min_doc_count": "1",
787 + "order": "desc",
788 + "orderBy": "_count",
789 + "size": "10"
790 + },
791 + "type": "terms"
792 + },
793 + {
794 + "field": "timestamp",
795 + "id": "2",
796 + "settings": {
797 + "interval": "auto"
798 + },
799 + "type": "date_histogram"
800 + }
801 + ],
802 + "datasource": {
803 + "type": "grafana-opensearch-datasource",
804 + "uid": "replace_datasource_uid"
805 + },
806 + "metrics": [
807 + {
808 + "id": "3",
809 + "type": "count"
810 + }
811 + ],
812 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
813 + "refId": "A",
814 + "timeField": "timestamp"
815 + }
816 + ],
817 + "title": "SRC IP (Top 10)",
818 + "type": "bargauge"
819 + },
820 + {
821 + "datasource": {
822 + "type": "grafana-opensearch-datasource",
823 + "uid": "replace_datasource_uid"
824 + },
825 + "fieldConfig": {
826 + "defaults": {
827 + "color": {
828 + "mode": "thresholds"
829 + },
830 + "custom": {
831 + "hideFrom": {
832 + "legend": false,
833 + "tooltip": false,
834 + "viz": false
835 + }
836 + },
837 + "mappings": [],
838 + "thresholds": {
839 + "mode": "absolute",
840 + "steps": [
841 + {
842 + "color": "rgba(245, 54, 54, 0.9)",
843 + "value": null
844 + },
845 + {
846 + "color": "rgba(237, 129, 40, 0.89)",
847 + "value": 0
848 + },
849 + {
850 + "color": "rgba(50, 172, 45, 0.97)",
851 + "value": 10
852 + }
853 + ]
854 + }
855 + },
856 + "overrides": []
857 + },
858 + "gridPos": {
859 + "h": 8,
860 + "w": 8,
861 + "x": 10,
862 + "y": 16
863 + },
864 + "id": 21,
865 + "maxDataPoints": 1,
866 + "options": {
867 + "basemap": {
868 + "name": "Basemap",
869 + "type": "default"
870 + },
871 + "controls": {
872 + "mouseWheelZoom": false,
873 + "showAttribution": true,
874 + "showDebug": false,
875 + "showMeasure": false,
876 + "showScale": false,
877 + "showZoom": true
878 + },
879 + "layers": [
880 + {
881 + "config": {
882 + "showLegend": true,
883 + "style": {
884 + "color": {
885 + "fixed": "dark-green"
886 + },
887 + "opacity": 0.4,
888 + "rotation": {
889 + "fixed": 0,
890 + "max": 360,
891 + "min": -360,
892 + "mode": "mod"
893 + },
894 + "size": {
895 + "fixed": 5,
896 + "max": 30,
897 + "min": 2
898 + },
899 + "symbol": {
900 + "fixed": "img/icons/marker/circle.svg",
901 + "mode": "fixed"
902 + },
903 + "symbolAlign": {
904 + "horizontal": "center",
905 + "vertical": "center"
906 + },
907 + "textConfig": {
908 + "fontSize": 12,
909 + "offsetX": 0,
910 + "offsetY": 0,
911 + "textAlign": "center",
912 + "textBaseline": "middle"
913 + }
914 + }
915 + },
916 + "location": {
917 + "gazetteer": "public/gazetteer/countries.json",
918 + "mode": "lookup"
919 + },
920 + "name": "Layer 0",
921 + "tooltip": true,
922 + "type": "markers"
923 + }
924 + ],
925 + "tooltip": {
926 + "mode": "details"
927 + },
928 + "view": {
929 + "allLayers": true,
930 + "id": "zero",
931 + "lat": 0,
932 + "lon": 0,
933 + "zoom": 1
934 + }
935 + },
936 + "pluginVersion": "10.4.1",
937 + "targets": [
938 + {
939 + "bucketAggs": [
940 + {
941 + "fake": true,
942 + "field": "src_ip_country_code",
943 + "id": "3",
944 + "settings": {
945 + "min_doc_count": 1,
946 + "order": "desc",
947 + "orderBy": "_term",
948 + "size": "0"
949 + },
950 + "type": "terms"
951 + },
952 + {
953 + "field": "timestamp",
954 + "id": "2",
955 + "settings": {
956 + "interval": "auto",
957 + "min_doc_count": 0,
958 + "trimEdges": 0
959 + },
960 + "type": "date_histogram"
961 + }
962 + ],
963 + "datasource": {
964 + "type": "grafana-opensearch-datasource",
965 + "uid": "replace_datasource_uid"
966 + },
967 + "metrics": [
968 + {
969 + "field": "select field",
970 + "id": "1",
971 + "type": "count"
972 + }
973 + ],
974 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
975 + "refId": "A",
976 + "timeField": "timestamp"
977 + }
978 + ],
979 + "title": "SRC GEOIP",
980 + "transformations": [
981 + {
982 + "id": "reduce",
983 + "options": {
984 + "reducers": [
985 + "sum"
986 + ]
987 + }
988 + }
989 + ],
990 + "type": "geomap"
991 + },
992 + {
993 + "datasource": {
994 + "type": "grafana-opensearch-datasource",
995 + "uid": "replace_datasource_uid"
996 + },
997 + "fieldConfig": {
998 + "defaults": {
999 + "color": {
1000 + "mode": "thresholds"
1001 + },
1002 + "custom": {
1003 + "align": "auto",
1004 + "cellOptions": {
1005 + "type": "auto"
1006 + },
1007 + "inspect": false
1008 + },
1009 + "mappings": [],
1010 + "thresholds": {
1011 + "mode": "absolute",
1012 + "steps": [
1013 + {
1014 + "color": "green",
1015 + "value": null
1016 + },
1017 + {
1018 + "color": "red",
1019 + "value": 80
1020 + }
1021 + ]
1022 + }
1023 + },
1024 + "overrides": [
1025 + {
1026 + "matcher": {
1027 + "id": "byName",
1028 + "options": "source"
1029 + },
1030 + "properties": [
1031 + {
1032 + "id": "custom.width",
1033 + "value": 473
1034 + }
1035 + ]
1036 + }
1037 + ]
1038 + },
1039 + "gridPos": {
1040 + "h": 8,
1041 + "w": 6,
1042 + "x": 18,
1043 + "y": 16
1044 + },
1045 + "id": 27,
1046 + "options": {
1047 + "cellHeight": "sm",
1048 + "footer": {
1049 + "countRows": false,
1050 + "fields": "",
1051 + "reducer": [
1052 + "sum"
1053 + ],
1054 + "show": false
1055 + },
1056 + "showHeader": true,
1057 + "sortBy": []
1058 + },
1059 + "pluginVersion": "10.4.1",
1060 + "targets": [
1061 + {
1062 + "alias": "",
1063 + "bucketAggs": [
1064 + {
1065 + "field": "src_ip",
1066 + "id": "3",
1067 + "settings": {
1068 + "min_doc_count": "1",
1069 + "order": "desc",
1070 + "orderBy": "_count",
1071 + "size": "20"
1072 + },
1073 + "type": "terms"
1074 + },
1075 + {
1076 + "field": "src_ip_country_code",
1077 + "id": "4",
1078 + "settings": {
1079 + "min_doc_count": "1",
1080 + "order": "desc",
1081 + "orderBy": "_count",
1082 + "size": "20"
1083 + },
1084 + "type": "terms"
1085 + }
1086 + ],
1087 + "datasource": {
1088 + "type": "grafana-opensearch-datasource",
1089 + "uid": "replace_datasource_uid"
1090 + },
1091 + "metrics": [
1092 + {
1093 + "id": "1",
1094 + "type": "count"
1095 + }
1096 + ],
1097 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
1098 + "refId": "A",
1099 + "timeField": "timestamp"
1100 + }
1101 + ],
1102 + "title": "SRC IP AND COUNTRY",
1103 + "transformations": [
1104 + {
1105 + "id": "organize",
1106 + "options": {
1107 + "excludeByName": {},
1108 + "indexByName": {},
1109 + "renameByName": {
1110 + "devname": "FIREWALL",
1111 + "fw": "FIREWALL"
1112 + }
1113 + }
1114 + }
1115 + ],
1116 + "transparent": true,
1117 + "type": "table"
1118 + },
1119 + {
1120 + "datasource": {
1121 + "type": "grafana-opensearch-datasource",
1122 + "uid": "replace_datasource_uid"
1123 + },
1124 + "fieldConfig": {
1125 + "defaults": {
1126 + "color": {
1127 + "mode": "palette-classic"
1128 + },
1129 + "custom": {
1130 + "hideFrom": {
1131 + "legend": false,
1132 + "tooltip": false,
1133 + "viz": false
1134 + }
1135 + },
1136 + "mappings": []
1137 + },
1138 + "overrides": [
1139 + {
1140 + "matcher": {
1141 + "id": "byName",
1142 + "options": "INFO"
1143 + },
1144 + "properties": [
1145 + {
1146 + "id": "color",
1147 + "value": {
1148 + "fixedColor": "blue",
1149 + "mode": "fixed"
1150 + }
1151 + }
1152 + ]
1153 + },
1154 + {
1155 + "matcher": {
1156 + "id": "byName",
1157 + "options": "Alert"
1158 + },
1159 + "properties": [
1160 + {
1161 + "id": "color",
1162 + "value": {
1163 + "fixedColor": "light-red",
1164 + "mode": "fixed"
1165 + }
1166 + }
1167 + ]
1168 + },
1169 + {
1170 + "matcher": {
1171 + "id": "byName",
1172 + "options": "Notice"
1173 + },
1174 + "properties": [
1175 + {
1176 + "id": "color",
1177 + "value": {
1178 + "fixedColor": "light-blue",
1179 + "mode": "fixed"
1180 + }
1181 + }
1182 + ]
1183 + },
1184 + {
1185 + "matcher": {
1186 + "id": "byName",
1187 + "options": "Warning"
1188 + },
1189 + "properties": [
1190 + {
1191 + "id": "color",
1192 + "value": {
1193 + "fixedColor": "orange",
1194 + "mode": "fixed"
1195 + }
1196 + }
1197 + ]
1198 + }
1199 + ]
1200 + },
1201 + "gridPos": {
1202 + "h": 8,
1203 + "w": 6,
1204 + "x": 0,
1205 + "y": 24
1206 + },
1207 + "id": 8,
1208 + "options": {
1209 + "legend": {
1210 + "displayMode": "table",
1211 + "placement": "right",
1212 + "showLegend": true
1213 + },
1214 + "pieType": "donut",
1215 + "reduceOptions": {
1216 + "calcs": [
1217 + "sum"
1218 + ],
1219 + "fields": "",
1220 + "values": false
1221 + },
1222 + "tooltip": {
1223 + "mode": "single",
1224 + "sort": "none"
1225 + }
1226 + },
1227 + "targets": [
1228 + {
1229 + "alias": "",
1230 + "bucketAggs": [
1231 + {
1232 + "field": "syslog_level",
1233 + "id": "3",
1234 + "settings": {
1235 + "min_doc_count": "1",
1236 + "order": "desc",
1237 + "orderBy": "_count",
1238 + "size": "15"
1239 + },
1240 + "type": "terms"
1241 + },
1242 + {
1243 + "field": "timestamp",
1244 + "id": "2",
1245 + "settings": {
1246 + "interval": "auto"
1247 + },
1248 + "type": "date_histogram"
1249 + }
1250 + ],
1251 + "datasource": {
1252 + "type": "grafana-opensearch-datasource",
1253 + "uid": "replace_datasource_uid"
1254 + },
1255 + "metrics": [
1256 + {
1257 + "id": "1",
1258 + "type": "count"
1259 + }
1260 + ],
1261 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
1262 + "refId": "A",
1263 + "timeField": "timestamp"
1264 + }
1265 + ],
1266 + "title": "LOGS BY SEVERITY",
1267 + "type": "piechart"
1268 + },
1269 + {
1270 + "datasource": {
1271 + "type": "grafana-opensearch-datasource",
1272 + "uid": "replace_datasource_uid"
1273 + },
1274 + "fieldConfig": {
1275 + "defaults": {
1276 + "color": {
1277 + "mode": "palette-classic"
1278 + },
1279 + "custom": {
1280 + "axisBorderShow": false,
1281 + "axisCenteredZero": false,
1282 + "axisColorMode": "text",
1283 + "axisLabel": "",
1284 + "axisPlacement": "auto",
1285 + "barAlignment": 0,
1286 + "drawStyle": "bars",
1287 + "fillOpacity": 0,
1288 + "gradientMode": "none",
1289 + "hideFrom": {
1290 + "legend": false,
1291 + "tooltip": false,
1292 + "viz": false
1293 + },
1294 + "insertNulls": false,
1295 + "lineInterpolation": "linear",
1296 + "lineWidth": 1,
1297 + "pointSize": 5,
1298 + "scaleDistribution": {
1299 + "type": "linear"
1300 + },
1301 + "showPoints": "auto",
1302 + "spanNulls": false,
1303 + "stacking": {
1304 + "group": "A",
1305 + "mode": "none"
1306 + },
1307 + "thresholdsStyle": {
1308 + "mode": "off"
1309 + }
1310 + },
1311 + "mappings": [],
1312 + "thresholds": {
1313 + "mode": "absolute",
1314 + "steps": [
1315 + {
1316 + "color": "green",
1317 + "value": null
1318 + },
1319 + {
1320 + "color": "red",
1321 + "value": 80
1322 + }
1323 + ]
1324 + },
1325 + "unit": "short"
1326 + },
1327 + "overrides": []
1328 + },
1329 + "gridPos": {
1330 + "h": 16,
1331 + "w": 18,
1332 + "x": 6,
1333 + "y": 24
1334 + },
1335 + "id": 7,
1336 + "options": {
1337 + "legend": {
1338 + "calcs": [],
1339 + "displayMode": "table",
1340 + "placement": "right",
1341 + "showLegend": true
1342 + },
1343 + "tooltip": {
1344 + "mode": "single",
1345 + "sort": "none"
1346 + }
1347 + },
1348 + "pluginVersion": "8.5.1",
1349 + "targets": [
1350 + {
1351 + "alias": "",
1352 + "bucketAggs": [
1353 + {
1354 + "field": "fw",
1355 + "id": "3",
1356 + "settings": {
1357 + "min_doc_count": "1",
1358 + "order": "desc",
1359 + "orderBy": "_count",
1360 + "size": "20"
1361 + },
1362 + "type": "terms"
1363 + },
1364 + {
1365 + "field": "timestamp",
1366 + "id": "4",
1367 + "settings": {
1368 + "interval": "5m",
1369 + "min_doc_count": "1",
1370 + "timeZone": "utc",
1371 + "trimEdges": "0"
1372 + },
1373 + "type": "date_histogram"
1374 + }
1375 + ],
1376 + "datasource": {
1377 + "type": "grafana-opensearch-datasource",
1378 + "uid": "replace_datasource_uid"
1379 + },
1380 + "metrics": [
1381 + {
1382 + "id": "1",
1383 + "type": "count"
1384 + }
1385 + ],
1386 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
1387 + "refId": "A",
1388 + "timeField": "timestamp"
1389 + }
1390 + ],
1391 + "title": "LOGS BY FIREWALL - HISTOGRAM (TOP 20)",
1392 + "type": "timeseries"
1393 + },
1394 + {
1395 + "datasource": {
1396 + "type": "grafana-opensearch-datasource",
1397 + "uid": "replace_datasource_uid"
1398 + },
1399 + "fieldConfig": {
1400 + "defaults": {
1401 + "color": {
1402 + "mode": "palette-classic"
1403 + },
1404 + "custom": {
1405 + "hideFrom": {
1406 + "legend": false,
1407 + "tooltip": false,
1408 + "viz": false
1409 + }
1410 + },
1411 + "mappings": []
1412 + },
1413 + "overrides": [
1414 + {
1415 + "matcher": {
1416 + "id": "byName",
1417 + "options": "information"
1418 + },
1419 + "properties": [
1420 + {
1421 + "id": "color",
1422 + "value": {
1423 + "fixedColor": "blue",
1424 + "mode": "fixed"
1425 + }
1426 + }
1427 + ]
1428 + },
1429 + {
1430 + "matcher": {
1431 + "id": "byName",
1432 + "options": "notice"
1433 + },
1434 + "properties": [
1435 + {
1436 + "id": "color",
1437 + "value": {
1438 + "fixedColor": "green",
1439 + "mode": "fixed"
1440 + }
1441 + }
1442 + ]
1443 + },
1444 + {
1445 + "matcher": {
1446 + "id": "byName",
1447 + "options": "warning"
1448 + },
1449 + "properties": [
1450 + {
1451 + "id": "color",
1452 + "value": {
1453 + "fixedColor": "orange",
1454 + "mode": "fixed"
1455 + }
1456 + }
1457 + ]
1458 + },
1459 + {
1460 + "matcher": {
1461 + "id": "byName",
1462 + "options": "alert"
1463 + },
1464 + "properties": [
1465 + {
1466 + "id": "color",
1467 + "value": {
1468 + "fixedColor": "red",
1469 + "mode": "fixed"
1470 + }
1471 + }
1472 + ]
1473 + },
1474 + {
1475 + "matcher": {
1476 + "id": "byName",
1477 + "options": "block-url"
1478 + },
1479 + "properties": [
1480 + {
1481 + "id": "color",
1482 + "value": {
1483 + "fixedColor": "orange",
1484 + "mode": "fixed"
1485 + }
1486 + }
1487 + ]
1488 + },
1489 + {
1490 + "matcher": {
1491 + "id": "byName",
1492 + "options": "passthrough"
1493 + },
1494 + "properties": [
1495 + {
1496 + "id": "color",
1497 + "value": {
1498 + "fixedColor": "green",
1499 + "mode": "fixed"
1500 + }
1501 + }
1502 + ]
1503 + },
1504 + {
1505 + "matcher": {
1506 + "id": "byName",
1507 + "options": "NA"
1508 + },
1509 + "properties": [
1510 + {
1511 + "id": "color",
1512 + "value": {
1513 + "fixedColor": "orange",
1514 + "mode": "fixed"
1515 + }
1516 + }
1517 + ]
1518 + },
1519 + {
1520 + "matcher": {
1521 + "id": "byName",
1522 + "options": "drop"
1523 + },
1524 + "properties": [
1525 + {
1526 + "id": "color",
1527 + "value": {
1528 + "fixedColor": "red",
1529 + "mode": "fixed"
1530 + }
1531 + }
1532 + ]
1533 + },
1534 + {
1535 + "matcher": {
1536 + "id": "byName",
1537 + "options": "forward"
1538 + },
1539 + "properties": [
1540 + {
1541 + "id": "color",
1542 + "value": {
1543 + "fixedColor": "green",
1544 + "mode": "fixed"
1545 + }
1546 + }
1547 + ]
1548 + },
1549 + {
1550 + "matcher": {
1551 + "id": "byName",
1552 + "options": "mgmt"
1553 + },
1554 + "properties": [
1555 + {
1556 + "id": "color",
1557 + "value": {
1558 + "fixedColor": "blue",
1559 + "mode": "fixed"
1560 + }
1561 + }
1562 + ]
1563 + }
1564 + ]
1565 + },
1566 + "gridPos": {
1567 + "h": 8,
1568 + "w": 6,
1569 + "x": 0,
1570 + "y": 32
1571 + },
1572 + "id": 12,
1573 + "options": {
1574 + "legend": {
1575 + "displayMode": "table",
1576 + "placement": "right",
1577 + "showLegend": true
1578 + },
1579 + "pieType": "donut",
1580 + "reduceOptions": {
1581 + "calcs": [
1582 + "sum"
1583 + ],
1584 + "fields": "",
1585 + "values": false
1586 + },
1587 + "tooltip": {
1588 + "mode": "single",
1589 + "sort": "none"
1590 + }
1591 + },
1592 + "targets": [
1593 + {
1594 + "alias": "",
1595 + "bucketAggs": [
1596 + {
1597 + "field": "fw_action",
1598 + "id": "3",
1599 + "settings": {
1600 + "min_doc_count": "1",
1601 + "order": "desc",
1602 + "orderBy": "_count",
1603 + "size": "15"
1604 + },
1605 + "type": "terms"
1606 + },
1607 + {
1608 + "field": "timestamp",
1609 + "id": "2",
1610 + "settings": {
1611 + "interval": "auto"
1612 + },
1613 + "type": "date_histogram"
1614 + }
1615 + ],
1616 + "datasource": {
1617 + "type": "grafana-opensearch-datasource",
1618 + "uid": "replace_datasource_uid"
1619 + },
1620 + "metrics": [
1621 + {
1622 + "id": "1",
1623 + "type": "count"
1624 + }
1625 + ],
1626 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
1627 + "refId": "A",
1628 + "timeField": "timestamp"
1629 + }
1630 + ],
1631 + "title": "TRAFFIC LOGS BY ACTION",
1632 + "type": "piechart"
1633 + },
1634 + {
1635 + "datasource": {
1636 + "type": "grafana-opensearch-datasource",
1637 + "uid": "replace_datasource_uid"
1638 + },
1639 + "fieldConfig": {
1640 + "defaults": {
1641 + "color": {
1642 + "mode": "palette-classic"
1643 + },
1644 + "custom": {
1645 + "hideFrom": {
1646 + "legend": false,
1647 + "tooltip": false,
1648 + "viz": false
1649 + }
1650 + },
1651 + "mappings": []
1652 + },
1653 + "overrides": []
1654 + },
1655 + "gridPos": {
1656 + "h": 8,
1657 + "w": 6,
1658 + "x": 0,
1659 + "y": 40
1660 + },
1661 + "id": 17,
1662 + "options": {
1663 + "legend": {
1664 + "displayMode": "list",
1665 + "placement": "right",
1666 + "showLegend": false
1667 + },
1668 + "pieType": "pie",
1669 + "reduceOptions": {
1670 + "calcs": [
1671 + "sum"
1672 + ],
1673 + "fields": "",
1674 + "values": false
1675 + },
1676 + "tooltip": {
1677 + "mode": "single",
1678 + "sort": "none"
1679 + }
1680 + },
1681 + "targets": [
1682 + {
1683 + "alias": "",
1684 + "bucketAggs": [
1685 + {
1686 + "field": "msg_detail",
1687 + "id": "3",
1688 + "settings": {
1689 + "min_doc_count": "1",
1690 + "order": "desc",
1691 + "orderBy": "_count",
1692 + "size": "15"
1693 + },
1694 + "type": "terms"
1695 + },
1696 + {
1697 + "field": "timestamp",
1698 + "id": "2",
1699 + "settings": {
1700 + "interval": "auto"
1701 + },
1702 + "type": "date_histogram"
1703 + }
1704 + ],
1705 + "datasource": {
1706 + "type": "grafana-opensearch-datasource",
1707 + "uid": "replace_datasource_uid"
1708 + },
1709 + "metrics": [
1710 + {
1711 + "id": "1",
1712 + "type": "count"
1713 + }
1714 + ],
1715 + "query": "fw:$firewall",
1716 + "refId": "A",
1717 + "timeField": "timestamp"
1718 + }
1719 + ],
1720 + "title": "LOGS BY NSG DETAIL (Top 15)",
1721 + "type": "piechart"
1722 + },
1723 + {
1724 + "datasource": {
1725 + "type": "grafana-opensearch-datasource",
1726 + "uid": "replace_datasource_uid"
1727 + },
1728 + "fieldConfig": {
1729 + "defaults": {
1730 + "color": {
1731 + "mode": "thresholds"
1732 + },
1733 + "custom": {
1734 + "align": "auto",
1735 + "cellOptions": {
1736 + "type": "auto"
1737 + },
1738 + "inspect": false
1739 + },
1740 + "mappings": [],
1741 + "thresholds": {
1742 + "mode": "absolute",
1743 + "steps": [
1744 + {
1745 + "color": "green"
1746 + },
1747 + {
1748 + "color": "red",
1749 + "value": 80
1750 + }
1751 + ]
1752 + }
1753 + },
1754 + "overrides": [
1755 + {
1756 + "matcher": {
1757 + "id": "byName",
1758 + "options": "source"
1759 + },
1760 + "properties": [
1761 + {
1762 + "id": "custom.width",
1763 + "value": 473
1764 + }
1765 + ]
1766 + },
1767 + {
1768 + "matcher": {
1769 + "id": "byName",
1770 + "options": "USER ACCOUNT"
1771 + },
1772 + "properties": [
1773 + {
1774 + "id": "custom.width",
1775 + "value": 422
1776 + }
1777 + ]
1778 + },
1779 + {
1780 + "matcher": {
1781 + "id": "byName",
1782 + "options": "INDICATOR"
1783 + },
1784 + "properties": [
1785 + {
1786 + "id": "custom.width",
1787 + "value": 439
1788 + }
1789 + ]
1790 + },
1791 + {
1792 + "matcher": {
1793 + "id": "byName",
1794 + "options": "msg_detail"
1795 + },
1796 + "properties": [
1797 + {
1798 + "id": "custom.width",
1799 + "value": 796
1800 + }
1801 + ]
1802 + }
1803 + ]
1804 + },
1805 + "gridPos": {
1806 + "h": 8,
1807 + "w": 18,
1808 + "x": 6,
1809 + "y": 40
1810 + },
1811 + "id": 14,
1812 + "options": {
1813 + "footer": {
1814 + "fields": "",
1815 + "reducer": [
1816 + "sum"
1817 + ],
1818 + "show": false
1819 + },
1820 + "showHeader": true,
1821 + "sortBy": []
1822 + },
1823 + "pluginVersion": "9.0.6",
1824 + "targets": [
1825 + {
1826 + "alias": "",
1827 + "bucketAggs": [
1828 + {
1829 + "field": "msg_detail",
1830 + "id": "3",
1831 + "settings": {
1832 + "min_doc_count": "1",
1833 + "order": "desc",
1834 + "orderBy": "_count",
1835 + "size": "0"
1836 + },
1837 + "type": "terms"
1838 + }
1839 + ],
1840 + "datasource": {
1841 + "type": "grafana-opensearch-datasource",
1842 + "uid": "replace_datasource_uid"
1843 + },
1844 + "metrics": [
1845 + {
1846 + "id": "1",
1847 + "type": "count"
1848 + }
1849 + ],
1850 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
1851 + "refId": "A",
1852 + "timeField": "timestamp"
1853 + }
1854 + ],
1855 + "title": "LOGS BY MSG DETAIL",
1856 + "transformations": [
1857 + {
1858 + "id": "organize",
1859 + "options": {
1860 + "excludeByName": {},
1861 + "indexByName": {},
1862 + "renameByName": {
1863 + "msg": "INDICATOR",
1864 + "msg_cat": "MSG CATEGORY",
1865 + "user": "USER ACCOUNT"
1866 + }
1867 + }
1868 + }
1869 + ],
1870 + "transparent": true,
1871 + "type": "table"
1872 + },
1873 + {
1874 + "datasource": {
1875 + "type": "grafana-opensearch-datasource",
1876 + "uid": "replace_datasource_uid"
1877 + },
1878 + "fieldConfig": {
1879 + "defaults": {
1880 + "color": {
1881 + "mode": "thresholds"
1882 + },
1883 + "custom": {
1884 + "align": "auto",
1885 + "cellOptions": {
1886 + "type": "auto"
1887 + },
1888 + "inspect": false
1889 + },
1890 + "mappings": [],
1891 + "thresholds": {
1892 + "mode": "absolute",
1893 + "steps": [
1894 + {
1895 + "color": "green"
1896 + },
1897 + {
1898 + "color": "red",
1899 + "value": 80
1900 + }
1901 + ]
1902 + }
1903 + },
1904 + "overrides": [
1905 + {
1906 + "matcher": {
1907 + "id": "byName",
1908 + "options": "FIREWALL"
1909 + },
1910 + "properties": [
1911 + {
1912 + "id": "custom.width",
1913 + "value": 149
1914 + }
1915 + ]
1916 + },
1917 + {
1918 + "matcher": {
1919 + "id": "byName",
1920 + "options": "ACTION"
1921 + },
1922 + "properties": [
1923 + {
1924 + "id": "custom.width",
1925 + "value": 105
1926 + }
1927 + ]
1928 + },
1929 + {
1930 + "matcher": {
1931 + "id": "byName",
1932 + "options": "SEVERITY"
1933 + },
1934 + "properties": [
1935 + {
1936 + "id": "custom.width",
1937 + "value": 109
1938 + },
1939 + {
1940 + "id": "custom.cellOptions",
1941 + "value": {
1942 + "type": "color-text"
1943 + }
1944 + },
1945 + {
1946 + "id": "mappings",
1947 + "value": [
1948 + {
1949 + "options": {
1950 + "Alert": {
1951 + "color": "red",
1952 + "index": 3
1953 + },
1954 + "Critical": {
1955 + "color": "dark-red",
1956 + "index": 4
1957 + },
1958 + "Emergency": {
1959 + "color": "purple",
1960 + "index": 6
1961 + },
1962 + "Error": {
1963 + "color": "red",
1964 + "index": 5
1965 + },
1966 + "Info": {
1967 + "color": "green",
1968 + "index": 1
1969 + },
1970 + "Notice": {
1971 + "color": "blue",
1972 + "index": 0
1973 + },
1974 + "Warning": {
1975 + "color": "orange",
1976 + "index": 2
1977 + }
1978 + },
1979 + "type": "value"
1980 + }
1981 + ]
1982 + }
1983 + ]
1984 + },
1985 + {
1986 + "matcher": {
1987 + "id": "byName",
1988 + "options": "SRC IP"
1989 + },
1990 + "properties": [
1991 + {
1992 + "id": "custom.width",
1993 + "value": 137
1994 + }
1995 + ]
1996 + },
1997 + {
1998 + "matcher": {
1999 + "id": "byName",
2000 + "options": "SRC PORT"
2001 + },
2002 + "properties": [
2003 + {
2004 + "id": "custom.width",
2005 + "value": 87
2006 + }
2007 + ]
2008 + },
2009 + {
2010 + "matcher": {
2011 + "id": "byName",
2012 + "options": "IF IN"
2013 + },
2014 + "properties": [
2015 + {
2016 + "id": "custom.width",
2017 + "value": 110
2018 + }
2019 + ]
2020 + },
2021 + {
2022 + "matcher": {
2023 + "id": "byName",
2024 + "options": "APP"
2025 + },
2026 + "properties": [
2027 + {
2028 + "id": "custom.width",
2029 + "value": 131
2030 + }
2031 + ]
2032 + },
2033 + {
2034 + "matcher": {
2035 + "id": "byName",
2036 + "options": "DST IP"
2037 + },
2038 + "properties": [
2039 + {
2040 + "id": "custom.width",
2041 + "value": 134
2042 + }
2043 + ]
2044 + },
2045 + {
2046 + "matcher": {
2047 + "id": "byName",
2048 + "options": "DST PORT"
2049 + },
2050 + "properties": [
2051 + {
2052 + "id": "custom.width",
2053 + "value": 93
2054 + }
2055 + ]
2056 + },
2057 + {
2058 + "matcher": {
2059 + "id": "byName",
2060 + "options": "EVENT ID"
2061 + },
2062 + "properties": [
2063 + {
2064 + "id": "links",
2065 + "value": [
2066 + {
2067 + "targetBlank": true,
2068 + "title": "EVENT DETAILS",
2069 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SONICWALL%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D"
2070 + }
2071 + ]
2072 + },
2073 + {
2074 + "id": "custom.width",
2075 + "value": 214
2076 + }
2077 + ]
2078 + },
2079 + {
2080 + "matcher": {
2081 + "id": "byName",
2082 + "options": "SERVICE"
2083 + },
2084 + "properties": [
2085 + {
2086 + "id": "custom.width",
2087 + "value": 95
2088 + }
2089 + ]
2090 + },
2091 + {
2092 + "matcher": {
2093 + "id": "byName",
2094 + "options": "DATE/TIME"
2095 + },
2096 + "properties": [
2097 + {
2098 + "id": "custom.width",
2099 + "value": 188
2100 + }
2101 + ]
2102 + },
2103 + {
2104 + "matcher": {
2105 + "id": "byName",
2106 + "options": "PROFILE"
2107 + },
2108 + "properties": [
2109 + {
2110 + "id": "custom.width",
2111 + "value": 234
2112 + }
2113 + ]
2114 + },
2115 + {
2116 + "matcher": {
2117 + "id": "byName",
2118 + "options": "SRC IF"
2119 + },
2120 + "properties": [
2121 + {
2122 + "id": "custom.width",
2123 + "value": 74
2124 + }
2125 + ]
2126 + },
2127 + {
2128 + "matcher": {
2129 + "id": "byName",
2130 + "options": "PROTO"
2131 + },
2132 + "properties": [
2133 + {
2134 + "id": "custom.width",
2135 + "value": 117
2136 + }
2137 + ]
2138 + },
2139 + {
2140 + "matcher": {
2141 + "id": "byName",
2142 + "options": "DST IF"
2143 + },
2144 + "properties": [
2145 + {
2146 + "id": "custom.width",
2147 + "value": 95
2148 + }
2149 + ]
2150 + }
2151 + ]
2152 + },
2153 + "gridPos": {
2154 + "h": 15,
2155 + "w": 24,
2156 + "x": 0,
2157 + "y": 48
2158 + },
2159 + "id": 16,
2160 + "options": {
2161 + "footer": {
2162 + "fields": "",
2163 + "reducer": [
2164 + "sum"
2165 + ],
2166 + "show": false
2167 + },
2168 + "showHeader": true,
2169 + "sortBy": []
2170 + },
2171 + "pluginVersion": "9.0.6",
2172 + "targets": [
2173 + {
2174 + "alias": "",
2175 + "bucketAggs": [],
2176 + "datasource": {
2177 + "type": "grafana-opensearch-datasource",
2178 + "uid": "replace_datasource_uid"
2179 + },
2180 + "metrics": [
2181 + {
2182 + "id": "1",
2183 + "settings": {
2184 + "size": "500"
2185 + },
2186 + "type": "raw_data"
2187 + }
2188 + ],
2189 + "query": "fw:$firewall AND msg_cat:\"IPS Detection Alert\"",
2190 + "refId": "A",
2191 + "timeField": "timestamp"
2192 + }
2193 + ],
2194 + "title": "FIREWALL EVENTS",
2195 + "transformations": [
2196 + {
2197 + "id": "organize",
2198 + "options": {
2199 + "excludeByName": {
2200 + "_index": true,
2201 + "_type": true,
2202 + "alert_category": true,
2203 + "alert_definitions_version": true,
2204 + "alertlight": true,
2205 + "app": true,
2206 + "appid": true,
2207 + "c": true,
2208 + "cat": true,
2209 + "catdesc": true,
2210 + "category": true,
2211 + "catid": true,
2212 + "craction": true,
2213 + "crlevel": true,
2214 + "crscore": true,
2215 + "devid": true,
2216 + "direction": true,
2217 + "dst": true,
2218 + "dstMAC": true,
2219 + "dst_host": true,
2220 + "dst_ip_city_name": true,
2221 + "dst_ip_country_code": true,
2222 + "dst_ip_geolocation": true,
2223 + "dstintf": true,
2224 + "dstintfrole": true,
2225 + "dstip": true,
2226 + "dstip_city_name": true,
2227 + "dstip_country_code": true,
2228 + "dstip_geolocation": true,
2229 + "dstport": true,
2230 + "eventtype": true,
2231 + "facility": true,
2232 + "facility_num": true,
2233 + "fw_city_name": true,
2234 + "fw_country_code": true,
2235 + "fw_geolocation": true,
2236 + "gl2_accounted_message_size": true,
2237 + "gl2_message_id": true,
2238 + "gl2_remote_ip": true,
2239 + "gl2_remote_port": true,
2240 + "gl2_source_input": true,
2241 + "gl2_source_node": true,
2242 + "group": true,
2243 + "highlight": true,
2244 + "hostname": true,
2245 + "hostname_city_name": true,
2246 + "hostname_country_code": true,
2247 + "hostname_geolocation": true,
2248 + "id": true,
2249 + "ipspri": true,
2250 + "level": true,
2251 + "logdesc": false,
2252 + "logver": true,
2253 + "m": true,
2254 + "message": true,
2255 + "method": true,
2256 + "msg": false,
2257 + "msg_cat": true,
2258 + "msg_detail": false,
2259 + "n": true,
2260 + "note": true,
2261 + "policyid": true,
2262 + "pri": true,
2263 + "proto": false,
2264 + "rcvdbyte": true,
2265 + "reqtype": true,
2266 + "rule": true,
2267 + "sentbyte": true,
2268 + "sessionid": true,
2269 + "sid": true,
2270 + "sn": true,
2271 + "sort": true,
2272 + "source": true,
2273 + "source_city_name": true,
2274 + "source_country_code": true,
2275 + "source_geolocation": true,
2276 + "src": true,
2277 + "srcMac": true,
2278 + "src_ip_city_name": true,
2279 + "src_ip_country_code": true,
2280 + "src_ip_geolocation": true,
2281 + "srcintf": true,
2282 + "srcintfrole": true,
2283 + "srcip": true,
2284 + "srcip_city_name": true,
2285 + "srcip_country_code": true,
2286 + "srcip_geolocation": true,
2287 + "srcport": true,
2288 + "streams": true,
2289 + "subtype": false,
2290 + "syslog_type": true,
2291 + "time": true,
2292 + "type": true,
2293 + "user": true,
2294 + "vd": true
2295 + },
2296 + "indexByName": {
2297 + "_id": 1,
2298 + "_index": 7,
2299 + "_type": 8,
2300 + "appid": 18,
2301 + "catid": 19,
2302 + "dst": 20,
2303 + "dstMAC": 21,
2304 + "dst_host": 22,
2305 + "dst_if": 26,
2306 + "dst_ip": 23,
2307 + "dst_ip_city_name": 27,
2308 + "dst_ip_country_code": 28,
2309 + "dst_ip_geolocation": 29,
2310 + "dst_port": 24,
2311 + "facility": 30,
2312 + "facility_num": 31,
2313 + "fw": 2,
2314 + "fw_action": 32,
2315 + "fw_city_name": 33,
2316 + "fw_country_code": 34,
2317 + "fw_geolocation": 35,
2318 + "gl2_accounted_message_size": 9,
2319 + "gl2_message_id": 10,
2320 + "gl2_remote_ip": 11,
2321 + "gl2_remote_port": 12,
2322 + "gl2_source_input": 13,
2323 + "gl2_source_node": 14,
2324 + "highlight": 36,
2325 + "id": 37,
2326 + "level": 38,
2327 + "message": 15,
2328 + "msg": 39,
2329 + "proto": 25,
2330 + "rule": 40,
2331 + "sid": 41,
2332 + "sn": 42,
2333 + "sort": 43,
2334 + "source": 6,
2335 + "source_city_name": 44,
2336 + "source_country_code": 45,
2337 + "source_geolocation": 46,
2338 + "src": 47,
2339 + "srcMac": 48,
2340 + "src_if": 5,
2341 + "src_ip": 3,
2342 + "src_ip_city_name": 49,
2343 + "src_ip_country_code": 50,
2344 + "src_ip_geolocation": 51,
2345 + "src_port": 4,
2346 + "streams": 16,
2347 + "syslog_type": 17,
2348 + "timestamp": 0
2349 + },
2350 + "renameByName": {
2351 + "_id": "EVENT ID",
2352 + "action": "ACTION",
2353 + "alert_signature": "SIGNATURE",
2354 + "app": "APP",
2355 + "destination_location_name": "LOCATION",
2356 + "devname": "FIREWALL",
2357 + "dst_if": "DST IF",
2358 + "dst_ip": "DST IP",
2359 + "dst_port": "DST PORT",
2360 + "dstip": "DST IP",
2361 + "dstport": "DST PORT",
2362 + "event_log_name": "",
2363 + "fw": "FIREWALL",
2364 + "fw_action": "ACTION",
2365 + "http_method": "METHOD",
2366 + "http_user_agent_name": "HTTP AGENT",
2367 + "ipscat": "IPS CAT",
2368 + "logdesc": "DESCRIPTION",
2369 + "msg": "MESSAGE",
2370 + "msg_detail": "MSG DETAIL",
2371 + "network_interface_in": "IF IN",
2372 + "network_interface_out": "IF OUT",
2373 + "network_transport": "",
2374 + "profile": "PROFILE",
2375 + "proto": "PROTO",
2376 + "rule_name": "RULE",
2377 + "service": "SERVICE",
2378 + "source": "",
2379 + "source_port": "SRC PORT",
2380 + "src_if": "SRC IF",
2381 + "src_ip": "SRC IP",
2382 + "src_port": "SRC PORT",
2383 + "srcip": "SRC IP",
2384 + "subtype": "SUBTYPE",
2385 + "syslog_level": "SEVERITY",
2386 + "timestamp": "DATE/TIME",
2387 + "url": "URL"
2388 + }
2389 + }
2390 + }
2391 + ],
2392 + "transparent": true,
2393 + "type": "table"
2394 + }
2395 + ],
2396 + "schemaVersion": 39,
2397 + "tags": [
2398 + "SONICWALL"
2399 + ],
2400 + "templating": {
2401 + "list": [
2402 + {
2403 + "datasource": {
2404 + "type": "grafana-opensearch-datasource",
2405 + "uid": "replace_datasource_uid"
2406 + },
2407 + "filters": [],
2408 + "hide": 0,
2409 + "label": "Filters",
2410 + "name": "Filters",
2411 + "skipUrlSync": false,
2412 + "type": "adhoc"
2413 + },
2414 + {
2415 + "current": {
2416 + "selected": false,
2417 + "text": "All",
2418 + "value": "$__all"
2419 + },
2420 + "datasource": {
2421 + "type": "grafana-opensearch-datasource",
2422 + "uid": "replace_datasource_uid"
2423 + },
2424 + "definition": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"msg_cat:\\\"IPS Detection Alert\\\"\"}",
2425 + "description": "FORTINET FIREWALL",
2426 + "hide": 0,
2427 + "includeAll": true,
2428 + "label": "Firewall",
2429 + "multi": false,
2430 + "name": "firewall",
2431 + "options": [],
2432 + "query": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"msg_cat:\\\"IPS Detection Alert\\\"\"}",
2433 + "refresh": 1,
2434 + "regex": "",
2435 + "skipUrlSync": false,
2436 + "sort": 0,
2437 + "type": "query"
2438 + }
2439 + ]
2440 + },
2441 + "time": {
2442 + "from": "now-6h",
2443 + "to": "now"
2444 + },
2445 + "timepicker": {},
2446 + "timezone": "",
2447 + "title": "SONICWALL - IPS",
2448 + "weekStart": ""
2449 +}
backend/app/connectors/grafana/dashboards/Sonicwall/sonicwall_sdwan.json new
+1438
@@ -0,0 +1,1438 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "grafana",
8 + "uid": "-- Grafana --"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "description": "SONICWALL - LOGS SUMMARY",
25 + "editable": false,
26 + "fiscalYearStartMonth": 0,
27 + "graphTooltip": 0,
28 + "id": null,
29 + "links": [
30 + {
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "SONICWALL"
37 + ],
38 + "targetBlank": true,
39 + "title": "SONICWALL DASHBOARDS",
40 + "tooltip": "",
41 + "type": "dashboards",
42 + "url": ""
43 + }
44 + ],
45 + "liveNow": false,
46 + "panels": [
47 + {
48 + "datasource": {
49 + "type": "grafana-opensearch-datasource",
50 + "uid": "replace_datasource_uid"
51 + },
52 + "fieldConfig": {
53 + "defaults": {
54 + "color": {
55 + "mode": "thresholds"
56 + },
57 + "mappings": [],
58 + "thresholds": {
59 + "mode": "absolute",
60 + "steps": [
61 + {
62 + "color": "blue",
63 + "value": null
64 + }
65 + ]
66 + },
67 + "unit": "short"
68 + },
69 + "overrides": []
70 + },
71 + "gridPos": {
72 + "h": 8,
73 + "w": 4,
74 + "x": 0,
75 + "y": 0
76 + },
77 + "id": 2,
78 + "options": {
79 + "colorMode": "value",
80 + "graphMode": "area",
81 + "justifyMode": "auto",
82 + "orientation": "auto",
83 + "reduceOptions": {
84 + "calcs": [
85 + "sum"
86 + ],
87 + "fields": "",
88 + "values": false
89 + },
90 + "showPercentChange": false,
91 + "textMode": "auto",
92 + "wideLayout": true
93 + },
94 + "pluginVersion": "10.4.1",
95 + "targets": [
96 + {
97 + "alias": "",
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto"
104 + },
105 + "type": "date_histogram"
106 + }
107 + ],
108 + "datasource": {
109 + "type": "grafana-opensearch-datasource",
110 + "uid": "replace_datasource_uid"
111 + },
112 + "metrics": [
113 + {
114 + "id": "1",
115 + "type": "count"
116 + }
117 + ],
118 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
119 + "refId": "A",
120 + "timeField": "timestamp"
121 + }
122 + ],
123 + "title": "SDWAN EVENTS",
124 + "type": "stat"
125 + },
126 + {
127 + "datasource": {
128 + "type": "grafana-opensearch-datasource",
129 + "uid": "replace_datasource_uid"
130 + },
131 + "fieldConfig": {
132 + "defaults": {
133 + "color": {
134 + "mode": "palette-classic"
135 + },
136 + "custom": {
137 + "hideFrom": {
138 + "legend": false,
139 + "tooltip": false,
140 + "viz": false
141 + }
142 + },
143 + "mappings": []
144 + },
145 + "overrides": []
146 + },
147 + "gridPos": {
148 + "h": 8,
149 + "w": 5,
150 + "x": 4,
151 + "y": 0
152 + },
153 + "id": 4,
154 + "options": {
155 + "legend": {
156 + "displayMode": "list",
157 + "placement": "right",
158 + "showLegend": false
159 + },
160 + "pieType": "pie",
161 + "reduceOptions": {
162 + "calcs": [
163 + "sum"
164 + ],
165 + "fields": "",
166 + "values": false
167 + },
168 + "tooltip": {
169 + "mode": "single",
170 + "sort": "none"
171 + }
172 + },
173 + "targets": [
174 + {
175 + "alias": "",
176 + "bucketAggs": [
177 + {
178 + "field": "fw",
179 + "id": "3",
180 + "settings": {
181 + "min_doc_count": "1",
182 + "order": "desc",
183 + "orderBy": "_count",
184 + "size": "15"
185 + },
186 + "type": "terms"
187 + },
188 + {
189 + "field": "timestamp",
190 + "id": "2",
191 + "settings": {
192 + "interval": "auto"
193 + },
194 + "type": "date_histogram"
195 + }
196 + ],
197 + "datasource": {
198 + "type": "grafana-opensearch-datasource",
199 + "uid": "replace_datasource_uid"
200 + },
201 + "metrics": [
202 + {
203 + "id": "1",
204 + "type": "count"
205 + }
206 + ],
207 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
208 + "refId": "A",
209 + "timeField": "timestamp"
210 + }
211 + ],
212 + "title": "SDWAN EVENTS BY FIREWALL",
213 + "type": "piechart"
214 + },
215 + {
216 + "datasource": {
217 + "type": "grafana-opensearch-datasource",
218 + "uid": "replace_datasource_uid"
219 + },
220 + "fieldConfig": {
221 + "defaults": {
222 + "color": {
223 + "mode": "thresholds"
224 + },
225 + "custom": {
226 + "align": "auto",
227 + "cellOptions": {
228 + "type": "auto"
229 + },
230 + "inspect": false
231 + },
232 + "mappings": [],
233 + "thresholds": {
234 + "mode": "absolute",
235 + "steps": [
236 + {
237 + "color": "green",
238 + "value": null
239 + },
240 + {
241 + "color": "red",
242 + "value": 80
243 + }
244 + ]
245 + }
246 + },
247 + "overrides": [
248 + {
249 + "matcher": {
250 + "id": "byName",
251 + "options": "source"
252 + },
253 + "properties": [
254 + {
255 + "id": "custom.width",
256 + "value": 473
257 + }
258 + ]
259 + }
260 + ]
261 + },
262 + "gridPos": {
263 + "h": 8,
264 + "w": 7,
265 + "x": 9,
266 + "y": 0
267 + },
268 + "id": 5,
269 + "options": {
270 + "cellHeight": "sm",
271 + "footer": {
272 + "countRows": false,
273 + "fields": "",
274 + "reducer": [
275 + "sum"
276 + ],
277 + "show": false
278 + },
279 + "showHeader": true,
280 + "sortBy": []
281 + },
282 + "pluginVersion": "10.4.1",
283 + "targets": [
284 + {
285 + "alias": "",
286 + "bucketAggs": [
287 + {
288 + "field": "fw",
289 + "id": "3",
290 + "settings": {
291 + "min_doc_count": "1",
292 + "order": "desc",
293 + "orderBy": "_count",
294 + "size": "20"
295 + },
296 + "type": "terms"
297 + }
298 + ],
299 + "datasource": {
300 + "type": "grafana-opensearch-datasource",
301 + "uid": "replace_datasource_uid"
302 + },
303 + "metrics": [
304 + {
305 + "id": "1",
306 + "type": "count"
307 + }
308 + ],
309 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
310 + "refId": "A",
311 + "timeField": "timestamp"
312 + }
313 + ],
314 + "title": "LOGS BY FIREWALL",
315 + "transformations": [
316 + {
317 + "id": "organize",
318 + "options": {
319 + "excludeByName": {},
320 + "indexByName": {},
321 + "renameByName": {
322 + "devname": "FIREWALL",
323 + "fw": "FIREWALL"
324 + }
325 + }
326 + }
327 + ],
328 + "transparent": true,
329 + "type": "table"
330 + },
331 + {
332 + "datasource": {
333 + "type": "grafana-opensearch-datasource",
334 + "uid": "replace_datasource_uid"
335 + },
336 + "fieldConfig": {
337 + "defaults": {
338 + "color": {
339 + "mode": "palette-classic"
340 + },
341 + "custom": {
342 + "hideFrom": {
343 + "legend": false,
344 + "tooltip": false,
345 + "viz": false
346 + }
347 + },
348 + "mappings": []
349 + },
350 + "overrides": [
351 + {
352 + "matcher": {
353 + "id": "byName",
354 + "options": "INFO"
355 + },
356 + "properties": [
357 + {
358 + "id": "color",
359 + "value": {
360 + "fixedColor": "blue",
361 + "mode": "fixed"
362 + }
363 + }
364 + ]
365 + },
366 + {
367 + "matcher": {
368 + "id": "byName",
369 + "options": "Alert"
370 + },
371 + "properties": [
372 + {
373 + "id": "color",
374 + "value": {
375 + "fixedColor": "light-red",
376 + "mode": "fixed"
377 + }
378 + }
379 + ]
380 + },
381 + {
382 + "matcher": {
383 + "id": "byName",
384 + "options": "Notice"
385 + },
386 + "properties": [
387 + {
388 + "id": "color",
389 + "value": {
390 + "fixedColor": "light-blue",
391 + "mode": "fixed"
392 + }
393 + }
394 + ]
395 + },
396 + {
397 + "matcher": {
398 + "id": "byName",
399 + "options": "Warning"
400 + },
401 + "properties": [
402 + {
403 + "id": "color",
404 + "value": {
405 + "fixedColor": "orange",
406 + "mode": "fixed"
407 + }
408 + }
409 + ]
410 + }
411 + ]
412 + },
413 + "gridPos": {
414 + "h": 8,
415 + "w": 6,
416 + "x": 0,
417 + "y": 8
418 + },
419 + "id": 8,
420 + "options": {
421 + "legend": {
422 + "displayMode": "table",
423 + "placement": "right",
424 + "showLegend": true
425 + },
426 + "pieType": "donut",
427 + "reduceOptions": {
428 + "calcs": [
429 + "sum"
430 + ],
431 + "fields": "",
432 + "values": false
433 + },
434 + "tooltip": {
435 + "mode": "single",
436 + "sort": "none"
437 + }
438 + },
439 + "targets": [
440 + {
441 + "alias": "",
442 + "bucketAggs": [
443 + {
444 + "field": "syslog_level",
445 + "id": "3",
446 + "settings": {
447 + "min_doc_count": "1",
448 + "order": "desc",
449 + "orderBy": "_count",
450 + "size": "15"
451 + },
452 + "type": "terms"
453 + },
454 + {
455 + "field": "timestamp",
456 + "id": "2",
457 + "settings": {
458 + "interval": "auto"
459 + },
460 + "type": "date_histogram"
461 + }
462 + ],
463 + "datasource": {
464 + "type": "grafana-opensearch-datasource",
465 + "uid": "replace_datasource_uid"
466 + },
467 + "metrics": [
468 + {
469 + "id": "1",
470 + "type": "count"
471 + }
472 + ],
473 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
474 + "refId": "A",
475 + "timeField": "timestamp"
476 + }
477 + ],
478 + "title": "LOGS BY SEVERITY",
479 + "type": "piechart"
480 + },
481 + {
482 + "datasource": {
483 + "type": "grafana-opensearch-datasource",
484 + "uid": "replace_datasource_uid"
485 + },
486 + "fieldConfig": {
487 + "defaults": {
488 + "color": {
489 + "mode": "palette-classic"
490 + },
491 + "custom": {
492 + "axisBorderShow": false,
493 + "axisCenteredZero": false,
494 + "axisColorMode": "text",
495 + "axisLabel": "",
496 + "axisPlacement": "auto",
497 + "barAlignment": 0,
498 + "drawStyle": "bars",
499 + "fillOpacity": 0,
500 + "gradientMode": "none",
501 + "hideFrom": {
502 + "legend": false,
503 + "tooltip": false,
504 + "viz": false
505 + },
506 + "insertNulls": false,
507 + "lineInterpolation": "linear",
508 + "lineWidth": 1,
509 + "pointSize": 5,
510 + "scaleDistribution": {
511 + "type": "linear"
512 + },
513 + "showPoints": "auto",
514 + "spanNulls": false,
515 + "stacking": {
516 + "group": "A",
517 + "mode": "none"
518 + },
519 + "thresholdsStyle": {
520 + "mode": "off"
521 + }
522 + },
523 + "mappings": [],
524 + "thresholds": {
525 + "mode": "absolute",
526 + "steps": [
527 + {
528 + "color": "green",
529 + "value": null
530 + },
531 + {
532 + "color": "red",
533 + "value": 80
534 + }
535 + ]
536 + },
537 + "unit": "short"
538 + },
539 + "overrides": []
540 + },
541 + "gridPos": {
542 + "h": 16,
543 + "w": 18,
544 + "x": 6,
545 + "y": 8
546 + },
547 + "id": 7,
548 + "options": {
549 + "legend": {
550 + "calcs": [],
551 + "displayMode": "table",
552 + "placement": "right",
553 + "showLegend": true
554 + },
555 + "tooltip": {
556 + "mode": "single",
557 + "sort": "none"
558 + }
559 + },
560 + "pluginVersion": "8.5.1",
561 + "targets": [
562 + {
563 + "alias": "",
564 + "bucketAggs": [
565 + {
566 + "field": "fw",
567 + "id": "3",
568 + "settings": {
569 + "min_doc_count": "1",
570 + "order": "desc",
571 + "orderBy": "_count",
572 + "size": "20"
573 + },
574 + "type": "terms"
575 + },
576 + {
577 + "field": "timestamp",
578 + "id": "4",
579 + "settings": {
580 + "interval": "5m",
581 + "min_doc_count": "1",
582 + "timeZone": "utc",
583 + "trimEdges": "0"
584 + },
585 + "type": "date_histogram"
586 + }
587 + ],
588 + "datasource": {
589 + "type": "grafana-opensearch-datasource",
590 + "uid": "replace_datasource_uid"
591 + },
592 + "metrics": [
593 + {
594 + "id": "1",
595 + "type": "count"
596 + }
597 + ],
598 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
599 + "refId": "A",
600 + "timeField": "timestamp"
601 + }
602 + ],
603 + "title": "LOGS BY FIREWALL - HISTOGRAM (TOP 20)",
604 + "type": "timeseries"
605 + },
606 + {
607 + "datasource": {
608 + "type": "grafana-opensearch-datasource",
609 + "uid": "replace_datasource_uid"
610 + },
611 + "fieldConfig": {
612 + "defaults": {
613 + "color": {
614 + "mode": "palette-classic"
615 + },
616 + "custom": {
617 + "hideFrom": {
618 + "legend": false,
619 + "tooltip": false,
620 + "viz": false
621 + }
622 + },
623 + "mappings": []
624 + },
625 + "overrides": [
626 + {
627 + "matcher": {
628 + "id": "byName",
629 + "options": "information"
630 + },
631 + "properties": [
632 + {
633 + "id": "color",
634 + "value": {
635 + "fixedColor": "blue",
636 + "mode": "fixed"
637 + }
638 + }
639 + ]
640 + },
641 + {
642 + "matcher": {
643 + "id": "byName",
644 + "options": "notice"
645 + },
646 + "properties": [
647 + {
648 + "id": "color",
649 + "value": {
650 + "fixedColor": "green",
651 + "mode": "fixed"
652 + }
653 + }
654 + ]
655 + },
656 + {
657 + "matcher": {
658 + "id": "byName",
659 + "options": "warning"
660 + },
661 + "properties": [
662 + {
663 + "id": "color",
664 + "value": {
665 + "fixedColor": "orange",
666 + "mode": "fixed"
667 + }
668 + }
669 + ]
670 + },
671 + {
672 + "matcher": {
673 + "id": "byName",
674 + "options": "alert"
675 + },
676 + "properties": [
677 + {
678 + "id": "color",
679 + "value": {
680 + "fixedColor": "red",
681 + "mode": "fixed"
682 + }
683 + }
684 + ]
685 + },
686 + {
687 + "matcher": {
688 + "id": "byName",
689 + "options": "block-url"
690 + },
691 + "properties": [
692 + {
693 + "id": "color",
694 + "value": {
695 + "fixedColor": "orange",
696 + "mode": "fixed"
697 + }
698 + }
699 + ]
700 + },
701 + {
702 + "matcher": {
703 + "id": "byName",
704 + "options": "passthrough"
705 + },
706 + "properties": [
707 + {
708 + "id": "color",
709 + "value": {
710 + "fixedColor": "green",
711 + "mode": "fixed"
712 + }
713 + }
714 + ]
715 + },
716 + {
717 + "matcher": {
718 + "id": "byName",
719 + "options": "NA"
720 + },
721 + "properties": [
722 + {
723 + "id": "color",
724 + "value": {
725 + "fixedColor": "orange",
726 + "mode": "fixed"
727 + }
728 + }
729 + ]
730 + },
731 + {
732 + "matcher": {
733 + "id": "byName",
734 + "options": "drop"
735 + },
736 + "properties": [
737 + {
738 + "id": "color",
739 + "value": {
740 + "fixedColor": "red",
741 + "mode": "fixed"
742 + }
743 + }
744 + ]
745 + },
746 + {
747 + "matcher": {
748 + "id": "byName",
749 + "options": "forward"
750 + },
751 + "properties": [
752 + {
753 + "id": "color",
754 + "value": {
755 + "fixedColor": "green",
756 + "mode": "fixed"
757 + }
758 + }
759 + ]
760 + },
761 + {
762 + "matcher": {
763 + "id": "byName",
764 + "options": "mgmt"
765 + },
766 + "properties": [
767 + {
768 + "id": "color",
769 + "value": {
770 + "fixedColor": "blue",
771 + "mode": "fixed"
772 + }
773 + }
774 + ]
775 + }
776 + ]
777 + },
778 + "gridPos": {
779 + "h": 8,
780 + "w": 6,
781 + "x": 0,
782 + "y": 16
783 + },
784 + "id": 12,
785 + "options": {
786 + "legend": {
787 + "displayMode": "table",
788 + "placement": "right",
789 + "showLegend": true
790 + },
791 + "pieType": "donut",
792 + "reduceOptions": {
793 + "calcs": [
794 + "sum"
795 + ],
796 + "fields": "",
797 + "values": false
798 + },
799 + "tooltip": {
800 + "mode": "single",
801 + "sort": "none"
802 + }
803 + },
804 + "targets": [
805 + {
806 + "alias": "",
807 + "bucketAggs": [
808 + {
809 + "field": "fw_action",
810 + "id": "3",
811 + "settings": {
812 + "min_doc_count": "1",
813 + "order": "desc",
814 + "orderBy": "_count",
815 + "size": "15"
816 + },
817 + "type": "terms"
818 + },
819 + {
820 + "field": "timestamp",
821 + "id": "2",
822 + "settings": {
823 + "interval": "auto"
824 + },
825 + "type": "date_histogram"
826 + }
827 + ],
828 + "datasource": {
829 + "type": "grafana-opensearch-datasource",
830 + "uid": "replace_datasource_uid"
831 + },
832 + "metrics": [
833 + {
834 + "id": "1",
835 + "type": "count"
836 + }
837 + ],
838 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
839 + "refId": "A",
840 + "timeField": "timestamp"
841 + }
842 + ],
843 + "title": "TRAFFIC LOGS BY ACTION",
844 + "type": "piechart"
845 + },
846 + {
847 + "datasource": {
848 + "type": "grafana-opensearch-datasource",
849 + "uid": "replace_datasource_uid"
850 + },
851 + "fieldConfig": {
852 + "defaults": {
853 + "color": {
854 + "mode": "thresholds"
855 + },
856 + "custom": {
857 + "align": "auto",
858 + "cellOptions": {
859 + "type": "auto"
860 + },
861 + "inspect": false
862 + },
863 + "mappings": [],
864 + "thresholds": {
865 + "mode": "absolute",
866 + "steps": [
867 + {
868 + "color": "green",
869 + "value": null
870 + },
871 + {
872 + "color": "red",
873 + "value": 80
874 + }
875 + ]
876 + }
877 + },
878 + "overrides": [
879 + {
880 + "matcher": {
881 + "id": "byName",
882 + "options": "FIREWALL"
883 + },
884 + "properties": [
885 + {
886 + "id": "custom.width",
887 + "value": 149
888 + }
889 + ]
890 + },
891 + {
892 + "matcher": {
893 + "id": "byName",
894 + "options": "ACTION"
895 + },
896 + "properties": [
897 + {
898 + "id": "custom.width",
899 + "value": 105
900 + }
901 + ]
902 + },
903 + {
904 + "matcher": {
905 + "id": "byName",
906 + "options": "SEVERITY"
907 + },
908 + "properties": [
909 + {
910 + "id": "custom.width",
911 + "value": 109
912 + },
913 + {
914 + "id": "custom.cellOptions",
915 + "value": {
916 + "type": "color-text"
917 + }
918 + },
919 + {
920 + "id": "mappings",
921 + "value": [
922 + {
923 + "options": {
924 + "Alert": {
925 + "color": "red",
926 + "index": 3
927 + },
928 + "Critical": {
929 + "color": "dark-red",
930 + "index": 4
931 + },
932 + "Emergency": {
933 + "color": "purple",
934 + "index": 6
935 + },
936 + "Error": {
937 + "color": "red",
938 + "index": 5
939 + },
940 + "Info": {
941 + "color": "green",
942 + "index": 1
943 + },
944 + "Notice": {
945 + "color": "blue",
946 + "index": 0
947 + },
948 + "Warning": {
949 + "color": "orange",
950 + "index": 2
951 + }
952 + },
953 + "type": "value"
954 + }
955 + ]
956 + }
957 + ]
958 + },
959 + {
960 + "matcher": {
961 + "id": "byName",
962 + "options": "SRC IP"
963 + },
964 + "properties": [
965 + {
966 + "id": "custom.width",
967 + "value": 137
968 + }
969 + ]
970 + },
971 + {
972 + "matcher": {
973 + "id": "byName",
974 + "options": "SRC PORT"
975 + },
976 + "properties": [
977 + {
978 + "id": "custom.width",
979 + "value": 87
980 + }
981 + ]
982 + },
983 + {
984 + "matcher": {
985 + "id": "byName",
986 + "options": "IF IN"
987 + },
988 + "properties": [
989 + {
990 + "id": "custom.width",
991 + "value": 110
992 + }
993 + ]
994 + },
995 + {
996 + "matcher": {
997 + "id": "byName",
998 + "options": "APP"
999 + },
1000 + "properties": [
1001 + {
1002 + "id": "custom.width",
1003 + "value": 131
1004 + }
1005 + ]
1006 + },
1007 + {
1008 + "matcher": {
1009 + "id": "byName",
1010 + "options": "DST IP"
1011 + },
1012 + "properties": [
1013 + {
1014 + "id": "custom.width",
1015 + "value": 134
1016 + }
1017 + ]
1018 + },
1019 + {
1020 + "matcher": {
1021 + "id": "byName",
1022 + "options": "DST PORT"
1023 + },
1024 + "properties": [
1025 + {
1026 + "id": "custom.width",
1027 + "value": 93
1028 + }
1029 + ]
1030 + },
1031 + {
1032 + "matcher": {
1033 + "id": "byName",
1034 + "options": "EVENT ID"
1035 + },
1036 + "properties": [
1037 + {
1038 + "id": "links",
1039 + "value": [
1040 + {
1041 + "targetBlank": true,
1042 + "title": "EVENT DETAILS",
1043 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SONICWALL%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D"
1044 + }
1045 + ]
1046 + },
1047 + {
1048 + "id": "custom.width",
1049 + "value": 214
1050 + }
1051 + ]
1052 + },
1053 + {
1054 + "matcher": {
1055 + "id": "byName",
1056 + "options": "SERVICE"
1057 + },
1058 + "properties": [
1059 + {
1060 + "id": "custom.width",
1061 + "value": 95
1062 + }
1063 + ]
1064 + },
1065 + {
1066 + "matcher": {
1067 + "id": "byName",
1068 + "options": "DATE/TIME"
1069 + },
1070 + "properties": [
1071 + {
1072 + "id": "custom.width",
1073 + "value": 188
1074 + }
1075 + ]
1076 + },
1077 + {
1078 + "matcher": {
1079 + "id": "byName",
1080 + "options": "PROFILE"
1081 + },
1082 + "properties": [
1083 + {
1084 + "id": "custom.width",
1085 + "value": 234
1086 + }
1087 + ]
1088 + },
1089 + {
1090 + "matcher": {
1091 + "id": "byName",
1092 + "options": "SRC IF"
1093 + },
1094 + "properties": [
1095 + {
1096 + "id": "custom.width",
1097 + "value": 74
1098 + }
1099 + ]
1100 + },
1101 + {
1102 + "matcher": {
1103 + "id": "byName",
1104 + "options": "PROTO"
1105 + },
1106 + "properties": [
1107 + {
1108 + "id": "custom.width",
1109 + "value": 117
1110 + }
1111 + ]
1112 + },
1113 + {
1114 + "matcher": {
1115 + "id": "byName",
1116 + "options": "DST IF"
1117 + },
1118 + "properties": [
1119 + {
1120 + "id": "custom.width",
1121 + "value": 95
1122 + }
1123 + ]
1124 + },
1125 + {
1126 + "matcher": {
1127 + "id": "byName",
1128 + "options": "FULL MSG"
1129 + },
1130 + "properties": [
1131 + {
1132 + "id": "custom.cellOptions",
1133 + "value": {
1134 + "type": "json-view"
1135 + }
1136 + }
1137 + ]
1138 + }
1139 + ]
1140 + },
1141 + "gridPos": {
1142 + "h": 15,
1143 + "w": 24,
1144 + "x": 0,
1145 + "y": 24
1146 + },
1147 + "id": 16,
1148 + "options": {
1149 + "cellHeight": "sm",
1150 + "footer": {
1151 + "countRows": false,
1152 + "fields": "",
1153 + "reducer": [
1154 + "sum"
1155 + ],
1156 + "show": false
1157 + },
1158 + "showHeader": true,
1159 + "sortBy": []
1160 + },
1161 + "pluginVersion": "10.4.1",
1162 + "targets": [
1163 + {
1164 + "alias": "",
1165 + "bucketAggs": [],
1166 + "datasource": {
1167 + "type": "grafana-opensearch-datasource",
1168 + "uid": "replace_datasource_uid"
1169 + },
1170 + "metrics": [
1171 + {
1172 + "id": "1",
1173 + "settings": {
1174 + "size": "500"
1175 + },
1176 + "type": "raw_data"
1177 + }
1178 + ],
1179 + "query": "fw:$firewall AND msg_cat:\"SD-WAN PSP\"",
1180 + "refId": "A",
1181 + "timeField": "timestamp"
1182 + }
1183 + ],
1184 + "title": "FIREWALL EVENTS",
1185 + "transformations": [
1186 + {
1187 + "id": "organize",
1188 + "options": {
1189 + "excludeByName": {
1190 + "_index": true,
1191 + "_type": true,
1192 + "alert_category": true,
1193 + "alert_definitions_version": true,
1194 + "alertlight": true,
1195 + "app": true,
1196 + "appid": true,
1197 + "c": true,
1198 + "cat": true,
1199 + "catdesc": true,
1200 + "category": true,
1201 + "catid": true,
1202 + "craction": true,
1203 + "crlevel": true,
1204 + "crscore": true,
1205 + "devid": true,
1206 + "direction": true,
1207 + "dst": true,
1208 + "dstMAC": true,
1209 + "dst_host": true,
1210 + "dst_ip_city_name": true,
1211 + "dst_ip_country_code": true,
1212 + "dst_ip_geolocation": true,
1213 + "dstintf": true,
1214 + "dstintfrole": true,
1215 + "dstip": true,
1216 + "dstip_city_name": true,
1217 + "dstip_country_code": true,
1218 + "dstip_geolocation": true,
1219 + "dstport": true,
1220 + "eventtype": true,
1221 + "facility": true,
1222 + "facility_num": true,
1223 + "fw_city_name": true,
1224 + "fw_country_code": true,
1225 + "fw_geolocation": true,
1226 + "gl2_accounted_message_size": true,
1227 + "gl2_message_id": true,
1228 + "gl2_remote_ip": true,
1229 + "gl2_remote_port": true,
1230 + "gl2_source_input": true,
1231 + "gl2_source_node": true,
1232 + "group": true,
1233 + "highlight": true,
1234 + "hostname": true,
1235 + "hostname_city_name": true,
1236 + "hostname_country_code": true,
1237 + "hostname_geolocation": true,
1238 + "id": true,
1239 + "level": true,
1240 + "logdesc": false,
1241 + "logver": true,
1242 + "m": true,
1243 + "message": false,
1244 + "method": true,
1245 + "msg": true,
1246 + "msg_cat": true,
1247 + "msg_detail": false,
1248 + "n": true,
1249 + "note": true,
1250 + "policyid": true,
1251 + "pri": true,
1252 + "proto": false,
1253 + "rcvdbyte": true,
1254 + "reqtype": true,
1255 + "rule": true,
1256 + "sentbyte": true,
1257 + "sessionid": true,
1258 + "sid": true,
1259 + "sn": true,
1260 + "sort": true,
1261 + "source": true,
1262 + "source_city_name": true,
1263 + "source_country_code": true,
1264 + "source_geolocation": true,
1265 + "src": true,
1266 + "srcMac": true,
1267 + "src_ip_city_name": true,
1268 + "src_ip_country_code": true,
1269 + "src_ip_geolocation": true,
1270 + "srcintf": true,
1271 + "srcintfrole": true,
1272 + "srcip": true,
1273 + "srcip_city_name": true,
1274 + "srcip_country_code": true,
1275 + "srcip_geolocation": true,
1276 + "srcport": true,
1277 + "streams": true,
1278 + "subtype": false,
1279 + "syslog_type": true,
1280 + "time": true,
1281 + "type": true,
1282 + "user": true,
1283 + "vd": true
1284 + },
1285 + "indexByName": {
1286 + "_id": 1,
1287 + "_index": 7,
1288 + "_type": 8,
1289 + "appid": 18,
1290 + "catid": 19,
1291 + "dst": 20,
1292 + "dstMAC": 21,
1293 + "dst_host": 22,
1294 + "dst_if": 26,
1295 + "dst_ip": 23,
1296 + "dst_ip_city_name": 27,
1297 + "dst_ip_country_code": 28,
1298 + "dst_ip_geolocation": 29,
1299 + "dst_port": 24,
1300 + "facility": 30,
1301 + "facility_num": 31,
1302 + "fw": 2,
1303 + "fw_action": 32,
1304 + "fw_city_name": 33,
1305 + "fw_country_code": 34,
1306 + "fw_geolocation": 35,
1307 + "gl2_accounted_message_size": 9,
1308 + "gl2_message_id": 10,
1309 + "gl2_remote_ip": 11,
1310 + "gl2_remote_port": 12,
1311 + "gl2_source_input": 13,
1312 + "gl2_source_node": 14,
1313 + "highlight": 36,
1314 + "id": 37,
1315 + "level": 38,
1316 + "message": 15,
1317 + "msg": 39,
1318 + "proto": 25,
1319 + "rule": 40,
1320 + "sid": 41,
1321 + "sn": 42,
1322 + "sort": 43,
1323 + "source": 6,
1324 + "source_city_name": 44,
1325 + "source_country_code": 45,
1326 + "source_geolocation": 46,
1327 + "src": 47,
1328 + "srcMac": 48,
1329 + "src_if": 5,
1330 + "src_ip": 3,
1331 + "src_ip_city_name": 49,
1332 + "src_ip_country_code": 50,
1333 + "src_ip_geolocation": 51,
1334 + "src_port": 4,
1335 + "streams": 16,
1336 + "syslog_type": 17,
1337 + "timestamp": 0
1338 + },
1339 + "renameByName": {
1340 + "_id": "EVENT ID",
1341 + "action": "ACTION",
1342 + "alert_signature": "SIGNATURE",
1343 + "app": "APP",
1344 + "destination_location_name": "LOCATION",
1345 + "devname": "FIREWALL",
1346 + "dst_if": "DST IF",
1347 + "dst_ip": "DST IP",
1348 + "dst_port": "DST PORT",
1349 + "dstip": "DST IP",
1350 + "dstport": "DST PORT",
1351 + "event_log_name": "",
1352 + "fw": "FIREWALL",
1353 + "fw_action": "ACTION",
1354 + "http_method": "METHOD",
1355 + "http_user_agent_name": "HTTP AGENT",
1356 + "logdesc": "DESCRIPTION",
1357 + "message": "FULL MSG",
1358 + "msg": "MESSAGE",
1359 + "msg_detail": "MSG DETAIL",
1360 + "network_interface_in": "IF IN",
1361 + "network_interface_out": "IF OUT",
1362 + "network_transport": "",
1363 + "profile": "PROFILE",
1364 + "proto": "PROTO",
1365 + "rule_name": "RULE",
1366 + "service": "SERVICE",
1367 + "source": "",
1368 + "source_port": "SRC PORT",
1369 + "src_if": "SRC IF",
1370 + "src_ip": "SRC IP",
1371 + "src_port": "SRC PORT",
1372 + "srcip": "SRC IP",
1373 + "subtype": "SUBTYPE",
1374 + "syslog_level": "SEVERITY",
1375 + "timestamp": "DATE/TIME",
1376 + "url": "URL"
1377 + }
1378 + }
1379 + }
1380 + ],
1381 + "transparent": true,
1382 + "type": "table"
1383 + }
1384 + ],
1385 + "schemaVersion": 39,
1386 + "tags": [
1387 + "SONICWALL"
1388 + ],
1389 + "templating": {
1390 + "list": [
1391 + {
1392 + "datasource": {
1393 + "type": "grafana-opensearch-datasource",
1394 + "uid": "replace_datasource_uid"
1395 + },
1396 + "filters": [],
1397 + "hide": 0,
1398 + "label": "Filters",
1399 + "name": "Filters",
1400 + "skipUrlSync": false,
1401 + "type": "adhoc"
1402 + },
1403 + {
1404 + "current": {
1405 + "selected": false,
1406 + "text": "All",
1407 + "value": "$__all"
1408 + },
1409 + "datasource": {
1410 + "type": "grafana-opensearch-datasource",
1411 + "uid": "replace_datasource_uid"
1412 + },
1413 + "definition": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"msg_cat:\\\"SD-WAN PSP\\\"\"}",
1414 + "description": "FORTINET FIREWALL",
1415 + "hide": 0,
1416 + "includeAll": true,
1417 + "label": "Firewall",
1418 + "multi": false,
1419 + "name": "firewall",
1420 + "options": [],
1421 + "query": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"msg_cat:\\\"SD-WAN PSP\\\"\"}",
1422 + "refresh": 1,
1423 + "regex": "",
1424 + "skipUrlSync": false,
1425 + "sort": 0,
1426 + "type": "query"
1427 + }
1428 + ]
1429 + },
1430 + "time": {
1431 + "from": "now-6h",
1432 + "to": "now"
1433 + },
1434 + "timepicker": {},
1435 + "timezone": "",
1436 + "title": "SONICWALL - SDWAN",
1437 + "weekStart": ""
1438 +}
backend/app/connectors/grafana/dashboards/Sonicwall/sonicwall_summary.json new
+1793
@@ -0,0 +1,1793 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "grafana",
8 + "uid": "-- Grafana --"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "description": "SONICWALL - LOGS SUMMARY",
25 + "editable": false,
26 + "fiscalYearStartMonth": 0,
27 + "graphTooltip": 0,
28 + "id": null,
29 + "links": [
30 + {
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "SONICWALL"
37 + ],
38 + "targetBlank": true,
39 + "title": "SONICWALL DASHBOARDS",
40 + "tooltip": "",
41 + "type": "dashboards",
42 + "url": ""
43 + }
44 + ],
45 + "liveNow": false,
46 + "panels": [
47 + {
48 + "datasource": {
49 + "type": "grafana-opensearch-datasource",
50 + "uid": "replace_datasource_uid"
51 + },
52 + "fieldConfig": {
53 + "defaults": {
54 + "color": {
55 + "mode": "thresholds"
56 + },
57 + "mappings": [],
58 + "thresholds": {
59 + "mode": "absolute",
60 + "steps": [
61 + {
62 + "color": "blue",
63 + "value": null
64 + }
65 + ]
66 + },
67 + "unit": "short"
68 + },
69 + "overrides": []
70 + },
71 + "gridPos": {
72 + "h": 8,
73 + "w": 4,
74 + "x": 0,
75 + "y": 0
76 + },
77 + "id": 2,
78 + "options": {
79 + "colorMode": "value",
80 + "graphMode": "area",
81 + "justifyMode": "auto",
82 + "orientation": "auto",
83 + "reduceOptions": {
84 + "calcs": [
85 + "sum"
86 + ],
87 + "fields": "",
88 + "values": false
89 + },
90 + "showPercentChange": false,
91 + "textMode": "auto",
92 + "wideLayout": true
93 + },
94 + "pluginVersion": "10.4.1",
95 + "targets": [
96 + {
97 + "alias": "",
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto"
104 + },
105 + "type": "date_histogram"
106 + }
107 + ],
108 + "datasource": {
109 + "type": "grafana-opensearch-datasource",
110 + "uid": "replace_datasource_uid"
111 + },
112 + "metrics": [
113 + {
114 + "id": "1",
115 + "type": "count"
116 + }
117 + ],
118 + "query": "fw:$firewall",
119 + "refId": "A",
120 + "timeField": "timestamp"
121 + }
122 + ],
123 + "title": "LOG COUNT",
124 + "type": "stat"
125 + },
126 + {
127 + "datasource": {
128 + "type": "grafana-opensearch-datasource",
129 + "uid": "replace_datasource_uid"
130 + },
131 + "fieldConfig": {
132 + "defaults": {
133 + "color": {
134 + "mode": "thresholds"
135 + },
136 + "mappings": [],
137 + "thresholds": {
138 + "mode": "absolute",
139 + "steps": [
140 + {
141 + "color": "blue",
142 + "value": null
143 + }
144 + ]
145 + },
146 + "unit": "short"
147 + },
148 + "overrides": []
149 + },
150 + "gridPos": {
151 + "h": 8,
152 + "w": 4,
153 + "x": 4,
154 + "y": 0
155 + },
156 + "id": 9,
157 + "options": {
158 + "colorMode": "value",
159 + "graphMode": "area",
160 + "justifyMode": "auto",
161 + "orientation": "auto",
162 + "reduceOptions": {
163 + "calcs": [
164 + "sum"
165 + ],
166 + "fields": "",
167 + "values": false
168 + },
169 + "showPercentChange": false,
170 + "textMode": "auto",
171 + "wideLayout": true
172 + },
173 + "pluginVersion": "10.4.1",
174 + "targets": [
175 + {
176 + "alias": "",
177 + "bucketAggs": [
178 + {
179 + "field": "timestamp",
180 + "id": "2",
181 + "settings": {
182 + "interval": "365d"
183 + },
184 + "type": "date_histogram"
185 + }
186 + ],
187 + "datasource": {
188 + "type": "grafana-opensearch-datasource",
189 + "uid": "replace_datasource_uid"
190 + },
191 + "metrics": [
192 + {
193 + "field": "msg_cat",
194 + "id": "1",
195 + "type": "cardinality"
196 + }
197 + ],
198 + "query": "fw:$firewall",
199 + "refId": "A",
200 + "timeField": "timestamp"
201 + }
202 + ],
203 + "title": "LOGS: MSG CATEGORIES",
204 + "type": "stat"
205 + },
206 + {
207 + "datasource": {
208 + "type": "grafana-opensearch-datasource",
209 + "uid": "replace_datasource_uid"
210 + },
211 + "fieldConfig": {
212 + "defaults": {
213 + "color": {
214 + "mode": "palette-classic"
215 + },
216 + "custom": {
217 + "hideFrom": {
218 + "legend": false,
219 + "tooltip": false,
220 + "viz": false
221 + }
222 + },
223 + "mappings": []
224 + },
225 + "overrides": []
226 + },
227 + "gridPos": {
228 + "h": 8,
229 + "w": 5,
230 + "x": 8,
231 + "y": 0
232 + },
233 + "id": 4,
234 + "options": {
235 + "legend": {
236 + "displayMode": "list",
237 + "placement": "right",
238 + "showLegend": false
239 + },
240 + "pieType": "pie",
241 + "reduceOptions": {
242 + "calcs": [
243 + "sum"
244 + ],
245 + "fields": "",
246 + "values": false
247 + },
248 + "tooltip": {
249 + "mode": "single",
250 + "sort": "none"
251 + }
252 + },
253 + "targets": [
254 + {
255 + "alias": "",
256 + "bucketAggs": [
257 + {
258 + "field": "fw",
259 + "id": "3",
260 + "settings": {
261 + "min_doc_count": "1",
262 + "order": "desc",
263 + "orderBy": "_count",
264 + "size": "15"
265 + },
266 + "type": "terms"
267 + },
268 + {
269 + "field": "timestamp",
270 + "id": "2",
271 + "settings": {
272 + "interval": "auto"
273 + },
274 + "type": "date_histogram"
275 + }
276 + ],
277 + "datasource": {
278 + "type": "grafana-opensearch-datasource",
279 + "uid": "replace_datasource_uid"
280 + },
281 + "metrics": [
282 + {
283 + "id": "1",
284 + "type": "count"
285 + }
286 + ],
287 + "query": "fw:$firewall",
288 + "refId": "A",
289 + "timeField": "timestamp"
290 + }
291 + ],
292 + "title": "LOGS BY FIREWALL",
293 + "type": "piechart"
294 + },
295 + {
296 + "datasource": {
297 + "type": "grafana-opensearch-datasource",
298 + "uid": "replace_datasource_uid"
299 + },
300 + "fieldConfig": {
301 + "defaults": {
302 + "color": {
303 + "mode": "thresholds"
304 + },
305 + "custom": {
306 + "align": "auto",
307 + "cellOptions": {
308 + "type": "auto"
309 + },
310 + "inspect": false
311 + },
312 + "mappings": [],
313 + "thresholds": {
314 + "mode": "absolute",
315 + "steps": [
316 + {
317 + "color": "green",
318 + "value": null
319 + },
320 + {
321 + "color": "red",
322 + "value": 80
323 + }
324 + ]
325 + }
326 + },
327 + "overrides": [
328 + {
329 + "matcher": {
330 + "id": "byName",
331 + "options": "source"
332 + },
333 + "properties": [
334 + {
335 + "id": "custom.width",
336 + "value": 473
337 + }
338 + ]
339 + }
340 + ]
341 + },
342 + "gridPos": {
343 + "h": 8,
344 + "w": 11,
345 + "x": 13,
346 + "y": 0
347 + },
348 + "id": 5,
349 + "options": {
350 + "cellHeight": "sm",
351 + "footer": {
352 + "countRows": false,
353 + "fields": "",
354 + "reducer": [
355 + "sum"
356 + ],
357 + "show": false
358 + },
359 + "showHeader": true,
360 + "sortBy": []
361 + },
362 + "pluginVersion": "10.4.1",
363 + "targets": [
364 + {
365 + "alias": "",
366 + "bucketAggs": [
367 + {
368 + "field": "fw",
369 + "id": "3",
370 + "settings": {
371 + "min_doc_count": "1",
372 + "order": "desc",
373 + "orderBy": "_count",
374 + "size": "20"
375 + },
376 + "type": "terms"
377 + }
378 + ],
379 + "datasource": {
380 + "type": "grafana-opensearch-datasource",
381 + "uid": "replace_datasource_uid"
382 + },
383 + "metrics": [
384 + {
385 + "id": "1",
386 + "type": "count"
387 + }
388 + ],
389 + "query": "fw:$firewall",
390 + "refId": "A",
391 + "timeField": "timestamp"
392 + }
393 + ],
394 + "title": "LOGS BY FIREWALL",
395 + "transformations": [
396 + {
397 + "id": "organize",
398 + "options": {
399 + "excludeByName": {},
400 + "indexByName": {},
401 + "renameByName": {
402 + "devname": "FIREWALL",
403 + "fw": "FIREWALL"
404 + }
405 + }
406 + }
407 + ],
408 + "transparent": true,
409 + "type": "table"
410 + },
411 + {
412 + "datasource": {
413 + "type": "grafana-opensearch-datasource",
414 + "uid": "replace_datasource_uid"
415 + },
416 + "fieldConfig": {
417 + "defaults": {
418 + "color": {
419 + "mode": "palette-classic"
420 + },
421 + "custom": {
422 + "hideFrom": {
423 + "legend": false,
424 + "tooltip": false,
425 + "viz": false
426 + }
427 + },
428 + "mappings": []
429 + },
430 + "overrides": [
431 + {
432 + "matcher": {
433 + "id": "byName",
434 + "options": "INFO"
435 + },
436 + "properties": [
437 + {
438 + "id": "color",
439 + "value": {
440 + "fixedColor": "blue",
441 + "mode": "fixed"
442 + }
443 + }
444 + ]
445 + },
446 + {
447 + "matcher": {
448 + "id": "byName",
449 + "options": "Alert"
450 + },
451 + "properties": [
452 + {
453 + "id": "color",
454 + "value": {
455 + "fixedColor": "light-red",
456 + "mode": "fixed"
457 + }
458 + }
459 + ]
460 + },
461 + {
462 + "matcher": {
463 + "id": "byName",
464 + "options": "Notice"
465 + },
466 + "properties": [
467 + {
468 + "id": "color",
469 + "value": {
470 + "fixedColor": "light-blue",
471 + "mode": "fixed"
472 + }
473 + }
474 + ]
475 + },
476 + {
477 + "matcher": {
478 + "id": "byName",
479 + "options": "Warning"
480 + },
481 + "properties": [
482 + {
483 + "id": "color",
484 + "value": {
485 + "fixedColor": "orange",
486 + "mode": "fixed"
487 + }
488 + }
489 + ]
490 + }
491 + ]
492 + },
493 + "gridPos": {
494 + "h": 8,
495 + "w": 6,
496 + "x": 0,
497 + "y": 8
498 + },
499 + "id": 8,
500 + "options": {
501 + "legend": {
502 + "displayMode": "table",
503 + "placement": "right",
504 + "showLegend": true
505 + },
506 + "pieType": "donut",
507 + "reduceOptions": {
508 + "calcs": [
509 + "sum"
510 + ],
511 + "fields": "",
512 + "values": false
513 + },
514 + "tooltip": {
515 + "mode": "single",
516 + "sort": "none"
517 + }
518 + },
519 + "targets": [
520 + {
521 + "alias": "",
522 + "bucketAggs": [
523 + {
524 + "field": "syslog_level",
525 + "id": "3",
526 + "settings": {
527 + "min_doc_count": "1",
528 + "order": "desc",
529 + "orderBy": "_count",
530 + "size": "15"
531 + },
532 + "type": "terms"
533 + },
534 + {
535 + "field": "timestamp",
536 + "id": "2",
537 + "settings": {
538 + "interval": "auto"
539 + },
540 + "type": "date_histogram"
541 + }
542 + ],
543 + "datasource": {
544 + "type": "grafana-opensearch-datasource",
545 + "uid": "replace_datasource_uid"
546 + },
547 + "metrics": [
548 + {
549 + "id": "1",
550 + "type": "count"
551 + }
552 + ],
553 + "query": "fw:$firewall",
554 + "refId": "A",
555 + "timeField": "timestamp"
556 + }
557 + ],
558 + "title": "LOGS BY SEVERITY",
559 + "type": "piechart"
560 + },
561 + {
562 + "datasource": {
563 + "type": "grafana-opensearch-datasource",
564 + "uid": "replace_datasource_uid"
565 + },
566 + "fieldConfig": {
567 + "defaults": {
568 + "color": {
569 + "mode": "palette-classic"
570 + },
571 + "custom": {
572 + "axisBorderShow": false,
573 + "axisCenteredZero": false,
574 + "axisColorMode": "text",
575 + "axisLabel": "",
576 + "axisPlacement": "auto",
577 + "barAlignment": 0,
578 + "drawStyle": "bars",
579 + "fillOpacity": 0,
580 + "gradientMode": "none",
581 + "hideFrom": {
582 + "legend": false,
583 + "tooltip": false,
584 + "viz": false
585 + },
586 + "insertNulls": false,
587 + "lineInterpolation": "linear",
588 + "lineWidth": 1,
589 + "pointSize": 5,
590 + "scaleDistribution": {
591 + "type": "linear"
592 + },
593 + "showPoints": "auto",
594 + "spanNulls": false,
595 + "stacking": {
596 + "group": "A",
597 + "mode": "none"
598 + },
599 + "thresholdsStyle": {
600 + "mode": "off"
601 + }
602 + },
603 + "mappings": [],
604 + "thresholds": {
605 + "mode": "absolute",
606 + "steps": [
607 + {
608 + "color": "green",
609 + "value": null
610 + },
611 + {
612 + "color": "red",
613 + "value": 80
614 + }
615 + ]
616 + },
617 + "unit": "short"
618 + },
619 + "overrides": []
620 + },
621 + "gridPos": {
622 + "h": 16,
623 + "w": 18,
624 + "x": 6,
625 + "y": 8
626 + },
627 + "id": 7,
628 + "options": {
629 + "legend": {
630 + "calcs": [],
631 + "displayMode": "table",
632 + "placement": "right",
633 + "showLegend": true
634 + },
635 + "tooltip": {
636 + "mode": "single",
637 + "sort": "none"
638 + }
639 + },
640 + "pluginVersion": "8.5.1",
641 + "targets": [
642 + {
643 + "alias": "",
644 + "bucketAggs": [
645 + {
646 + "field": "fw",
647 + "id": "3",
648 + "settings": {
649 + "min_doc_count": "1",
650 + "order": "desc",
651 + "orderBy": "_count",
652 + "size": "20"
653 + },
654 + "type": "terms"
655 + },
656 + {
657 + "field": "timestamp",
658 + "id": "4",
659 + "settings": {
660 + "interval": "5m",
661 + "min_doc_count": "1",
662 + "timeZone": "utc",
663 + "trimEdges": "0"
664 + },
665 + "type": "date_histogram"
666 + }
667 + ],
668 + "datasource": {
669 + "type": "grafana-opensearch-datasource",
670 + "uid": "replace_datasource_uid"
671 + },
672 + "metrics": [
673 + {
674 + "id": "1",
675 + "type": "count"
676 + }
677 + ],
678 + "query": "fw:$firewall",
679 + "refId": "A",
680 + "timeField": "timestamp"
681 + }
682 + ],
683 + "title": "LOGS BY FIREWALL - HISTOGRAM (TOP 20)",
684 + "type": "timeseries"
685 + },
686 + {
687 + "datasource": {
688 + "type": "grafana-opensearch-datasource",
689 + "uid": "replace_datasource_uid"
690 + },
691 + "fieldConfig": {
692 + "defaults": {
693 + "color": {
694 + "mode": "palette-classic"
695 + },
696 + "custom": {
697 + "hideFrom": {
698 + "legend": false,
699 + "tooltip": false,
700 + "viz": false
701 + }
702 + },
703 + "mappings": []
704 + },
705 + "overrides": [
706 + {
707 + "matcher": {
708 + "id": "byName",
709 + "options": "information"
710 + },
711 + "properties": [
712 + {
713 + "id": "color",
714 + "value": {
715 + "fixedColor": "blue",
716 + "mode": "fixed"
717 + }
718 + }
719 + ]
720 + },
721 + {
722 + "matcher": {
723 + "id": "byName",
724 + "options": "notice"
725 + },
726 + "properties": [
727 + {
728 + "id": "color",
729 + "value": {
730 + "fixedColor": "green",
731 + "mode": "fixed"
732 + }
733 + }
734 + ]
735 + },
736 + {
737 + "matcher": {
738 + "id": "byName",
739 + "options": "warning"
740 + },
741 + "properties": [
742 + {
743 + "id": "color",
744 + "value": {
745 + "fixedColor": "orange",
746 + "mode": "fixed"
747 + }
748 + }
749 + ]
750 + },
751 + {
752 + "matcher": {
753 + "id": "byName",
754 + "options": "alert"
755 + },
756 + "properties": [
757 + {
758 + "id": "color",
759 + "value": {
760 + "fixedColor": "red",
761 + "mode": "fixed"
762 + }
763 + }
764 + ]
765 + },
766 + {
767 + "matcher": {
768 + "id": "byName",
769 + "options": "block-url"
770 + },
771 + "properties": [
772 + {
773 + "id": "color",
774 + "value": {
775 + "fixedColor": "orange",
776 + "mode": "fixed"
777 + }
778 + }
779 + ]
780 + },
781 + {
782 + "matcher": {
783 + "id": "byName",
784 + "options": "passthrough"
785 + },
786 + "properties": [
787 + {
788 + "id": "color",
789 + "value": {
790 + "fixedColor": "green",
791 + "mode": "fixed"
792 + }
793 + }
794 + ]
795 + },
796 + {
797 + "matcher": {
798 + "id": "byName",
799 + "options": "NA"
800 + },
801 + "properties": [
802 + {
803 + "id": "color",
804 + "value": {
805 + "fixedColor": "orange",
806 + "mode": "fixed"
807 + }
808 + }
809 + ]
810 + },
811 + {
812 + "matcher": {
813 + "id": "byName",
814 + "options": "drop"
815 + },
816 + "properties": [
817 + {
818 + "id": "color",
819 + "value": {
820 + "fixedColor": "red",
821 + "mode": "fixed"
822 + }
823 + }
824 + ]
825 + },
826 + {
827 + "matcher": {
828 + "id": "byName",
829 + "options": "forward"
830 + },
831 + "properties": [
832 + {
833 + "id": "color",
834 + "value": {
835 + "fixedColor": "green",
836 + "mode": "fixed"
837 + }
838 + }
839 + ]
840 + },
841 + {
842 + "matcher": {
843 + "id": "byName",
844 + "options": "mgmt"
845 + },
846 + "properties": [
847 + {
848 + "id": "color",
849 + "value": {
850 + "fixedColor": "blue",
851 + "mode": "fixed"
852 + }
853 + }
854 + ]
855 + }
856 + ]
857 + },
858 + "gridPos": {
859 + "h": 8,
860 + "w": 6,
861 + "x": 0,
862 + "y": 16
863 + },
864 + "id": 12,
865 + "options": {
866 + "legend": {
867 + "displayMode": "table",
868 + "placement": "right",
869 + "showLegend": true
870 + },
871 + "pieType": "donut",
872 + "reduceOptions": {
873 + "calcs": [
874 + "sum"
875 + ],
876 + "fields": "",
877 + "values": false
878 + },
879 + "tooltip": {
880 + "mode": "single",
881 + "sort": "none"
882 + }
883 + },
884 + "targets": [
885 + {
886 + "alias": "",
887 + "bucketAggs": [
888 + {
889 + "field": "fw_action",
890 + "id": "3",
891 + "settings": {
892 + "min_doc_count": "1",
893 + "order": "desc",
894 + "orderBy": "_count",
895 + "size": "15"
896 + },
897 + "type": "terms"
898 + },
899 + {
900 + "field": "timestamp",
901 + "id": "2",
902 + "settings": {
903 + "interval": "auto"
904 + },
905 + "type": "date_histogram"
906 + }
907 + ],
908 + "datasource": {
909 + "type": "grafana-opensearch-datasource",
910 + "uid": "replace_datasource_uid"
911 + },
912 + "metrics": [
913 + {
914 + "id": "1",
915 + "type": "count"
916 + }
917 + ],
918 + "query": "fw:$firewall",
919 + "refId": "A",
920 + "timeField": "timestamp"
921 + }
922 + ],
923 + "title": "TRAFFIC LOGS BY ACTION",
924 + "type": "piechart"
925 + },
926 + {
927 + "datasource": {
928 + "type": "grafana-opensearch-datasource",
929 + "uid": "replace_datasource_uid"
930 + },
931 + "fieldConfig": {
932 + "defaults": {
933 + "color": {
934 + "mode": "palette-classic"
935 + },
936 + "custom": {
937 + "hideFrom": {
938 + "legend": false,
939 + "tooltip": false,
940 + "viz": false
941 + }
942 + },
943 + "mappings": []
944 + },
945 + "overrides": []
946 + },
947 + "gridPos": {
948 + "h": 8,
949 + "w": 6,
950 + "x": 0,
951 + "y": 24
952 + },
953 + "id": 17,
954 + "options": {
955 + "legend": {
956 + "displayMode": "list",
957 + "placement": "right",
958 + "showLegend": false
959 + },
960 + "pieType": "pie",
961 + "reduceOptions": {
962 + "calcs": [
963 + "sum"
964 + ],
965 + "fields": "",
966 + "values": false
967 + },
968 + "tooltip": {
969 + "mode": "single",
970 + "sort": "none"
971 + }
972 + },
973 + "targets": [
974 + {
975 + "alias": "",
976 + "bucketAggs": [
977 + {
978 + "field": "msg_cat",
979 + "id": "3",
980 + "settings": {
981 + "min_doc_count": "1",
982 + "order": "desc",
983 + "orderBy": "_count",
984 + "size": "15"
985 + },
986 + "type": "terms"
987 + },
988 + {
989 + "field": "timestamp",
990 + "id": "2",
991 + "settings": {
992 + "interval": "auto"
993 + },
994 + "type": "date_histogram"
995 + }
996 + ],
997 + "datasource": {
998 + "type": "grafana-opensearch-datasource",
999 + "uid": "replace_datasource_uid"
1000 + },
1001 + "metrics": [
1002 + {
1003 + "id": "1",
1004 + "type": "count"
1005 + }
1006 + ],
1007 + "query": "fw:$firewall",
1008 + "refId": "A",
1009 + "timeField": "timestamp"
1010 + }
1011 + ],
1012 + "title": "LOGS BY NSG CAT (Top 15)",
1013 + "type": "piechart"
1014 + },
1015 + {
1016 + "datasource": {
1017 + "type": "grafana-opensearch-datasource",
1018 + "uid": "replace_datasource_uid"
1019 + },
1020 + "fieldConfig": {
1021 + "defaults": {
1022 + "color": {
1023 + "mode": "thresholds"
1024 + },
1025 + "custom": {
1026 + "align": "auto",
1027 + "cellOptions": {
1028 + "type": "auto"
1029 + },
1030 + "inspect": false
1031 + },
1032 + "mappings": [],
1033 + "thresholds": {
1034 + "mode": "absolute",
1035 + "steps": [
1036 + {
1037 + "color": "green",
1038 + "value": null
1039 + },
1040 + {
1041 + "color": "red",
1042 + "value": 80
1043 + }
1044 + ]
1045 + }
1046 + },
1047 + "overrides": [
1048 + {
1049 + "matcher": {
1050 + "id": "byName",
1051 + "options": "source"
1052 + },
1053 + "properties": [
1054 + {
1055 + "id": "custom.width",
1056 + "value": 473
1057 + }
1058 + ]
1059 + },
1060 + {
1061 + "matcher": {
1062 + "id": "byName",
1063 + "options": "USER ACCOUNT"
1064 + },
1065 + "properties": [
1066 + {
1067 + "id": "custom.width",
1068 + "value": 422
1069 + }
1070 + ]
1071 + },
1072 + {
1073 + "matcher": {
1074 + "id": "byName",
1075 + "options": "INDICATOR"
1076 + },
1077 + "properties": [
1078 + {
1079 + "id": "custom.width",
1080 + "value": 439
1081 + }
1082 + ]
1083 + }
1084 + ]
1085 + },
1086 + "gridPos": {
1087 + "h": 8,
1088 + "w": 18,
1089 + "x": 6,
1090 + "y": 24
1091 + },
1092 + "id": 14,
1093 + "options": {
1094 + "cellHeight": "sm",
1095 + "footer": {
1096 + "countRows": false,
1097 + "fields": "",
1098 + "reducer": [
1099 + "sum"
1100 + ],
1101 + "show": false
1102 + },
1103 + "showHeader": true,
1104 + "sortBy": []
1105 + },
1106 + "pluginVersion": "10.4.1",
1107 + "targets": [
1108 + {
1109 + "alias": "",
1110 + "bucketAggs": [
1111 + {
1112 + "field": "msg_cat",
1113 + "id": "3",
1114 + "settings": {
1115 + "min_doc_count": "1",
1116 + "order": "desc",
1117 + "orderBy": "_count",
1118 + "size": "0"
1119 + },
1120 + "type": "terms"
1121 + }
1122 + ],
1123 + "datasource": {
1124 + "type": "grafana-opensearch-datasource",
1125 + "uid": "replace_datasource_uid"
1126 + },
1127 + "metrics": [
1128 + {
1129 + "id": "1",
1130 + "type": "count"
1131 + }
1132 + ],
1133 + "query": "fw:$firewall",
1134 + "refId": "A",
1135 + "timeField": "timestamp"
1136 + }
1137 + ],
1138 + "title": "LOGS BY MSG CATEGORY",
1139 + "transformations": [
1140 + {
1141 + "id": "organize",
1142 + "options": {
1143 + "excludeByName": {},
1144 + "indexByName": {},
1145 + "renameByName": {
1146 + "msg": "INDICATOR",
1147 + "msg_cat": "MSG CATEGORY",
1148 + "user": "USER ACCOUNT"
1149 + }
1150 + }
1151 + }
1152 + ],
1153 + "transparent": true,
1154 + "type": "table"
1155 + },
1156 + {
1157 + "datasource": {
1158 + "type": "grafana-opensearch-datasource",
1159 + "uid": "replace_datasource_uid"
1160 + },
1161 + "fieldConfig": {
1162 + "defaults": {
1163 + "color": {
1164 + "mode": "thresholds"
1165 + },
1166 + "custom": {
1167 + "align": "auto",
1168 + "cellOptions": {
1169 + "type": "auto"
1170 + },
1171 + "filterable": true,
1172 + "inspect": false
1173 + },
1174 + "mappings": [],
1175 + "thresholds": {
1176 + "mode": "absolute",
1177 + "steps": [
1178 + {
1179 + "color": "green",
1180 + "value": null
1181 + },
1182 + {
1183 + "color": "red",
1184 + "value": 80
1185 + }
1186 + ]
1187 + }
1188 + },
1189 + "overrides": [
1190 + {
1191 + "matcher": {
1192 + "id": "byName",
1193 + "options": "FIREWALL"
1194 + },
1195 + "properties": [
1196 + {
1197 + "id": "custom.width",
1198 + "value": 149
1199 + }
1200 + ]
1201 + },
1202 + {
1203 + "matcher": {
1204 + "id": "byName",
1205 + "options": "ACTION"
1206 + },
1207 + "properties": [
1208 + {
1209 + "id": "custom.width",
1210 + "value": 105
1211 + }
1212 + ]
1213 + },
1214 + {
1215 + "matcher": {
1216 + "id": "byName",
1217 + "options": "SEVERITY"
1218 + },
1219 + "properties": [
1220 + {
1221 + "id": "custom.width",
1222 + "value": 109
1223 + },
1224 + {
1225 + "id": "custom.cellOptions",
1226 + "value": {
1227 + "type": "color-text"
1228 + }
1229 + },
1230 + {
1231 + "id": "mappings",
1232 + "value": [
1233 + {
1234 + "options": {
1235 + "Alert": {
1236 + "color": "red",
1237 + "index": 3
1238 + },
1239 + "Critical": {
1240 + "color": "dark-red",
1241 + "index": 4
1242 + },
1243 + "Emergency": {
1244 + "color": "purple",
1245 + "index": 6
1246 + },
1247 + "Error": {
1248 + "color": "red",
1249 + "index": 5
1250 + },
1251 + "Info": {
1252 + "color": "green",
1253 + "index": 1
1254 + },
1255 + "Notice": {
1256 + "color": "blue",
1257 + "index": 0
1258 + },
1259 + "Warning": {
1260 + "color": "orange",
1261 + "index": 2
1262 + }
1263 + },
1264 + "type": "value"
1265 + }
1266 + ]
1267 + }
1268 + ]
1269 + },
1270 + {
1271 + "matcher": {
1272 + "id": "byName",
1273 + "options": "SRC IP"
1274 + },
1275 + "properties": [
1276 + {
1277 + "id": "custom.width",
1278 + "value": 137
1279 + }
1280 + ]
1281 + },
1282 + {
1283 + "matcher": {
1284 + "id": "byName",
1285 + "options": "SRC PORT"
1286 + },
1287 + "properties": [
1288 + {
1289 + "id": "custom.width",
1290 + "value": 87
1291 + }
1292 + ]
1293 + },
1294 + {
1295 + "matcher": {
1296 + "id": "byName",
1297 + "options": "IF IN"
1298 + },
1299 + "properties": [
1300 + {
1301 + "id": "custom.width",
1302 + "value": 110
1303 + }
1304 + ]
1305 + },
1306 + {
1307 + "matcher": {
1308 + "id": "byName",
1309 + "options": "APP"
1310 + },
1311 + "properties": [
1312 + {
1313 + "id": "custom.width",
1314 + "value": 131
1315 + }
1316 + ]
1317 + },
1318 + {
1319 + "matcher": {
1320 + "id": "byName",
1321 + "options": "DST IP"
1322 + },
1323 + "properties": [
1324 + {
1325 + "id": "custom.width",
1326 + "value": 134
1327 + }
1328 + ]
1329 + },
1330 + {
1331 + "matcher": {
1332 + "id": "byName",
1333 + "options": "DST PORT"
1334 + },
1335 + "properties": [
1336 + {
1337 + "id": "custom.width",
1338 + "value": 93
1339 + }
1340 + ]
1341 + },
1342 + {
1343 + "matcher": {
1344 + "id": "byName",
1345 + "options": "EVENT ID"
1346 + },
1347 + "properties": [
1348 + {
1349 + "id": "links",
1350 + "value": [
1351 + {
1352 + "targetBlank": true,
1353 + "title": "EVENT DETAILS",
1354 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SONICWALL%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D"
1355 + }
1356 + ]
1357 + },
1358 + {
1359 + "id": "custom.width",
1360 + "value": 214
1361 + }
1362 + ]
1363 + },
1364 + {
1365 + "matcher": {
1366 + "id": "byName",
1367 + "options": "SERVICE"
1368 + },
1369 + "properties": [
1370 + {
1371 + "id": "custom.width",
1372 + "value": 95
1373 + }
1374 + ]
1375 + },
1376 + {
1377 + "matcher": {
1378 + "id": "byName",
1379 + "options": "DATE/TIME"
1380 + },
1381 + "properties": [
1382 + {
1383 + "id": "custom.width",
1384 + "value": 188
1385 + }
1386 + ]
1387 + },
1388 + {
1389 + "matcher": {
1390 + "id": "byName",
1391 + "options": "PROFILE"
1392 + },
1393 + "properties": [
1394 + {
1395 + "id": "custom.width",
1396 + "value": 234
1397 + }
1398 + ]
1399 + },
1400 + {
1401 + "matcher": {
1402 + "id": "byName",
1403 + "options": "SRC IF"
1404 + },
1405 + "properties": [
1406 + {
1407 + "id": "custom.width",
1408 + "value": 74
1409 + }
1410 + ]
1411 + },
1412 + {
1413 + "matcher": {
1414 + "id": "byName",
1415 + "options": "PROTO"
1416 + },
1417 + "properties": [
1418 + {
1419 + "id": "custom.width",
1420 + "value": 117
1421 + }
1422 + ]
1423 + },
1424 + {
1425 + "matcher": {
1426 + "id": "byName",
1427 + "options": "DST IF"
1428 + },
1429 + "properties": [
1430 + {
1431 + "id": "custom.width",
1432 + "value": 95
1433 + }
1434 + ]
1435 + }
1436 + ]
1437 + },
1438 + "gridPos": {
1439 + "h": 15,
1440 + "w": 24,
1441 + "x": 0,
1442 + "y": 32
1443 + },
1444 + "id": 16,
1445 + "options": {
1446 + "cellHeight": "sm",
1447 + "footer": {
1448 + "countRows": false,
1449 + "enablePagination": true,
1450 + "fields": "",
1451 + "reducer": [
1452 + "sum"
1453 + ],
1454 + "show": false
1455 + },
1456 + "showHeader": true,
1457 + "sortBy": []
1458 + },
1459 + "pluginVersion": "10.4.1",
1460 + "targets": [
1461 + {
1462 + "alias": "",
1463 + "bucketAggs": [],
1464 + "datasource": {
1465 + "type": "grafana-opensearch-datasource",
1466 + "uid": "replace_datasource_uid"
1467 + },
1468 + "metrics": [
1469 + {
1470 + "id": "1",
1471 + "settings": {
1472 + "size": "500"
1473 + },
1474 + "type": "raw_data"
1475 + }
1476 + ],
1477 + "query": "fw:$firewall",
1478 + "refId": "A",
1479 + "timeField": "timestamp"
1480 + }
1481 + ],
1482 + "title": "FIREWALL EVENTS",
1483 + "transformations": [
1484 + {
1485 + "id": "filterFieldsByName",
1486 + "options": {
1487 + "include": {
1488 + "names": [
1489 + "timestamp",
1490 + "_id",
1491 + "fw",
1492 + "msg",
1493 + "msg_cat",
1494 + "syslog_level",
1495 + "fw_action",
1496 + "proto"
1497 + ]
1498 + }
1499 + }
1500 + },
1501 + {
1502 + "id": "organize",
1503 + "options": {
1504 + "excludeByName": {
1505 + "Category": true,
1506 + "_index": true,
1507 + "_type": true,
1508 + "alert_category": true,
1509 + "alert_definitions_version": true,
1510 + "alertlight": true,
1511 + "app": true,
1512 + "appName": true,
1513 + "appcat": true,
1514 + "appid": true,
1515 + "arg": true,
1516 + "bcastRx": true,
1517 + "bcastTx": true,
1518 + "bytesRx": true,
1519 + "bytesTx": true,
1520 + "c": true,
1521 + "cat": true,
1522 + "catdesc": true,
1523 + "category": true,
1524 + "catid": true,
1525 + "cdur": true,
1526 + "code": true,
1527 + "craction": true,
1528 + "crlevel": true,
1529 + "crscore": true,
1530 + "devid": true,
1531 + "direction": true,
1532 + "dpi": true,
1533 + "dst": true,
1534 + "dstMAC": true,
1535 + "dstMac": true,
1536 + "dstV6": true,
1537 + "dst_city_name": true,
1538 + "dst_country_code": true,
1539 + "dst_geolocation": true,
1540 + "dst_host": true,
1541 + "dst_ip_city_name": true,
1542 + "dst_ip_country_code": true,
1543 + "dst_ip_geolocation": true,
1544 + "dstintf": true,
1545 + "dstintfrole": true,
1546 + "dstip": true,
1547 + "dstip_city_name": true,
1548 + "dstip_country_code": true,
1549 + "dstip_geolocation": true,
1550 + "dstname": true,
1551 + "dstname_city_name": true,
1552 + "dstname_country_code": true,
1553 + "dstname_geolocation": true,
1554 + "dstport": true,
1555 + "eventtype": true,
1556 + "facility": true,
1557 + "facility_num": true,
1558 + "fw_city_name": true,
1559 + "fw_country_code": true,
1560 + "fw_geolocation": true,
1561 + "gl2_accounted_message_size": true,
1562 + "gl2_message_id": true,
1563 + "gl2_remote_ip": true,
1564 + "gl2_remote_port": true,
1565 + "gl2_source_input": true,
1566 + "gl2_source_node": true,
1567 + "group": true,
1568 + "highlight": true,
1569 + "hostname": true,
1570 + "hostname_city_name": true,
1571 + "hostname_country_code": true,
1572 + "hostname_geolocation": true,
1573 + "icmpCode": true,
1574 + "id": true,
1575 + "if": true,
1576 + "ipscat": true,
1577 + "ipspri": true,
1578 + "level": true,
1579 + "logdesc": false,
1580 + "logver": true,
1581 + "m": true,
1582 + "message": true,
1583 + "method": true,
1584 + "msg": false,
1585 + "msg_cat": false,
1586 + "msg_detail": true,
1587 + "n": true,
1588 + "note": true,
1589 + "op": true,
1590 + "policyid": true,
1591 + "pri": true,
1592 + "proto": false,
1593 + "rcvd": true,
1594 + "rcvdbyte": true,
1595 + "referer": true,
1596 + "reqtype": true,
1597 + "rpkt": true,
1598 + "rule": true,
1599 + "sent": true,
1600 + "sentbyte": true,
1601 + "sess": true,
1602 + "sessionid": true,
1603 + "sid": true,
1604 + "sn": true,
1605 + "sort": true,
1606 + "source": true,
1607 + "source_city_name": true,
1608 + "source_country_code": true,
1609 + "source_geolocation": true,
1610 + "spkt": true,
1611 + "src": true,
1612 + "srcMac": true,
1613 + "srcV6": true,
1614 + "src_city_name": true,
1615 + "src_country_code": true,
1616 + "src_geolocation": true,
1617 + "src_ip_city_name": true,
1618 + "src_ip_country_code": true,
1619 + "src_ip_geolocation": true,
1620 + "srcintf": true,
1621 + "srcintfrole": true,
1622 + "srcip": true,
1623 + "srcip_city_name": true,
1624 + "srcip_country_code": true,
1625 + "srcip_geolocation": true,
1626 + "srcport": true,
1627 + "streams": true,
1628 + "subtype": false,
1629 + "syslog_level": false,
1630 + "syslog_type": true,
1631 + "time": true,
1632 + "type": true,
1633 + "ucastRx": true,
1634 + "ucastTx": true,
1635 + "user": true,
1636 + "usr": true,
1637 + "vd": true,
1638 + "vpnpolicy": true
1639 + },
1640 + "includeByName": {},
1641 + "indexByName": {
1642 + "_id": 1,
1643 + "_index": 7,
1644 + "_type": 8,
1645 + "appid": 18,
1646 + "catid": 19,
1647 + "dst": 20,
1648 + "dstMAC": 21,
1649 + "dst_host": 22,
1650 + "dst_if": 26,
1651 + "dst_ip": 23,
1652 + "dst_ip_city_name": 27,
1653 + "dst_ip_country_code": 28,
1654 + "dst_ip_geolocation": 29,
1655 + "dst_port": 24,
1656 + "facility": 30,
1657 + "facility_num": 31,
1658 + "fw": 2,
1659 + "fw_action": 32,
1660 + "fw_city_name": 33,
1661 + "fw_country_code": 34,
1662 + "fw_geolocation": 35,
1663 + "gl2_accounted_message_size": 9,
1664 + "gl2_message_id": 10,
1665 + "gl2_remote_ip": 11,
1666 + "gl2_remote_port": 12,
1667 + "gl2_source_input": 13,
1668 + "gl2_source_node": 14,
1669 + "highlight": 36,
1670 + "id": 37,
1671 + "level": 38,
1672 + "message": 15,
1673 + "msg": 39,
1674 + "proto": 25,
1675 + "rule": 40,
1676 + "sid": 41,
1677 + "sn": 42,
1678 + "sort": 43,
1679 + "source": 6,
1680 + "source_city_name": 44,
1681 + "source_country_code": 45,
1682 + "source_geolocation": 46,
1683 + "src": 47,
1684 + "srcMac": 48,
1685 + "src_if": 5,
1686 + "src_ip": 3,
1687 + "src_ip_city_name": 49,
1688 + "src_ip_country_code": 50,
1689 + "src_ip_geolocation": 51,
1690 + "src_port": 4,
1691 + "streams": 16,
1692 + "syslog_type": 17,
1693 + "timestamp": 0
1694 + },
1695 + "renameByName": {
1696 + "_id": "EVENT ID",
1697 + "action": "ACTION",
1698 + "alert_signature": "SIGNATURE",
1699 + "app": "APP",
1700 + "destination_location_name": "LOCATION",
1701 + "devname": "FIREWALL",
1702 + "dst_if": "DST IF",
1703 + "dst_ip": "DST IP",
1704 + "dst_port": "DST PORT",
1705 + "dstip": "DST IP",
1706 + "dstport": "DST PORT",
1707 + "event_log_name": "",
1708 + "fw": "FIREWALL",
1709 + "fw_action": "ACTION",
1710 + "http_method": "METHOD",
1711 + "http_user_agent_name": "HTTP AGENT",
1712 + "logdesc": "DESCRIPTION",
1713 + "msg": "MESSAGE",
1714 + "msg_cat": "CAT",
1715 + "network_interface_in": "IF IN",
1716 + "network_interface_out": "IF OUT",
1717 + "network_transport": "",
1718 + "profile": "PROFILE",
1719 + "proto": "PROTO",
1720 + "rule_name": "RULE",
1721 + "service": "SERVICE",
1722 + "source": "",
1723 + "source_port": "SRC PORT",
1724 + "src_if": "SRC IF",
1725 + "src_ip": "SRC IP",
1726 + "src_port": "SRC PORT",
1727 + "srcip": "SRC IP",
1728 + "subtype": "SUBTYPE",
1729 + "syslog_level": "SEVERITY",
1730 + "timestamp": "DATE/TIME",
1731 + "url": "URL"
1732 + }
1733 + }
1734 + }
1735 + ],
1736 + "transparent": true,
1737 + "type": "table"
1738 + }
1739 + ],
1740 + "schemaVersion": 39,
1741 + "tags": [
1742 + "SONICWALL"
1743 + ],
1744 + "templating": {
1745 + "list": [
1746 + {
1747 + "datasource": {
1748 + "type": "grafana-opensearch-datasource",
1749 + "uid": "replace_datasource_uid"
1750 + },
1751 + "filters": [],
1752 + "hide": 0,
1753 + "label": "Filters",
1754 + "name": "Filters",
1755 + "skipUrlSync": false,
1756 + "type": "adhoc"
1757 + },
1758 + {
1759 + "current": {
1760 + "selected": false,
1761 + "text": "All",
1762 + "value": "$__all"
1763 + },
1764 + "datasource": {
1765 + "type": "grafana-opensearch-datasource",
1766 + "uid": "replace_datasource_uid"
1767 + },
1768 + "definition": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"*\"}",
1769 + "description": "FORTINET FIREWALL",
1770 + "hide": 0,
1771 + "includeAll": true,
1772 + "label": "Firewall",
1773 + "multi": false,
1774 + "name": "firewall",
1775 + "options": [],
1776 + "query": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"*\"}",
1777 + "refresh": 1,
1778 + "regex": "",
1779 + "skipUrlSync": false,
1780 + "sort": 0,
1781 + "type": "query"
1782 + }
1783 + ]
1784 + },
1785 + "time": {
1786 + "from": "now-6h",
1787 + "to": "now"
1788 + },
1789 + "timepicker": {},
1790 + "timezone": "",
1791 + "title": "SONICWALL - _LOGS SUMMARY",
1792 + "weekStart": ""
1793 +}
backend/app/connectors/grafana/dashboards/Sonicwall/sonicwall_vpn.json new
+2379
@@ -0,0 +1,2379 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "grafana",
8 + "uid": "-- Grafana --"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "description": "SONICWALL - LOGS SUMMARY",
25 + "editable": false,
26 + "fiscalYearStartMonth": 0,
27 + "graphTooltip": 0,
28 + "id": null,
29 + "links": [
30 + {
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "SONICWALL"
37 + ],
38 + "targetBlank": true,
39 + "title": "SONICWALL DASHBOARDS",
40 + "tooltip": "",
41 + "type": "dashboards",
42 + "url": ""
43 + }
44 + ],
45 + "liveNow": false,
46 + "panels": [
47 + {
48 + "datasource": {
49 + "type": "grafana-opensearch-datasource",
50 + "uid": "replace_datasource_uid"
51 + },
52 + "fieldConfig": {
53 + "defaults": {
54 + "color": {
55 + "mode": "thresholds"
56 + },
57 + "mappings": [],
58 + "thresholds": {
59 + "mode": "absolute",
60 + "steps": [
61 + {
62 + "color": "blue",
63 + "value": null
64 + }
65 + ]
66 + },
67 + "unit": "short"
68 + },
69 + "overrides": []
70 + },
71 + "gridPos": {
72 + "h": 8,
73 + "w": 4,
74 + "x": 0,
75 + "y": 0
76 + },
77 + "id": 2,
78 + "options": {
79 + "colorMode": "value",
80 + "graphMode": "area",
81 + "justifyMode": "auto",
82 + "orientation": "auto",
83 + "reduceOptions": {
84 + "calcs": [
85 + "sum"
86 + ],
87 + "fields": "",
88 + "values": false
89 + },
90 + "showPercentChange": false,
91 + "textMode": "auto",
92 + "wideLayout": true
93 + },
94 + "pluginVersion": "10.4.1",
95 + "targets": [
96 + {
97 + "alias": "",
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto"
104 + },
105 + "type": "date_histogram"
106 + }
107 + ],
108 + "datasource": {
109 + "type": "grafana-opensearch-datasource",
110 + "uid": "replace_datasource_uid"
111 + },
112 + "metrics": [
113 + {
114 + "id": "1",
115 + "type": "count"
116 + }
117 + ],
118 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
119 + "refId": "A",
120 + "timeField": "timestamp"
121 + }
122 + ],
123 + "title": "VPN EVENTS",
124 + "type": "stat"
125 + },
126 + {
127 + "datasource": {
128 + "type": "grafana-opensearch-datasource",
129 + "uid": "replace_datasource_uid"
130 + },
131 + "fieldConfig": {
132 + "defaults": {
133 + "color": {
134 + "mode": "palette-classic"
135 + },
136 + "custom": {
137 + "hideFrom": {
138 + "legend": false,
139 + "tooltip": false,
140 + "viz": false
141 + }
142 + },
143 + "mappings": []
144 + },
145 + "overrides": []
146 + },
147 + "gridPos": {
148 + "h": 8,
149 + "w": 5,
150 + "x": 4,
151 + "y": 0
152 + },
153 + "id": 4,
154 + "options": {
155 + "legend": {
156 + "displayMode": "list",
157 + "placement": "right",
158 + "showLegend": false
159 + },
160 + "pieType": "pie",
161 + "reduceOptions": {
162 + "calcs": [
163 + "sum"
164 + ],
165 + "fields": "",
166 + "values": false
167 + },
168 + "tooltip": {
169 + "mode": "single",
170 + "sort": "none"
171 + }
172 + },
173 + "targets": [
174 + {
175 + "alias": "",
176 + "bucketAggs": [
177 + {
178 + "field": "fw",
179 + "id": "3",
180 + "settings": {
181 + "min_doc_count": "1",
182 + "order": "desc",
183 + "orderBy": "_count",
184 + "size": "15"
185 + },
186 + "type": "terms"
187 + },
188 + {
189 + "field": "timestamp",
190 + "id": "2",
191 + "settings": {
192 + "interval": "auto"
193 + },
194 + "type": "date_histogram"
195 + }
196 + ],
197 + "datasource": {
198 + "type": "grafana-opensearch-datasource",
199 + "uid": "replace_datasource_uid"
200 + },
201 + "metrics": [
202 + {
203 + "id": "1",
204 + "type": "count"
205 + }
206 + ],
207 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
208 + "refId": "A",
209 + "timeField": "timestamp"
210 + }
211 + ],
212 + "title": "EVENTS BY FIREWALL",
213 + "type": "piechart"
214 + },
215 + {
216 + "datasource": {
217 + "type": "grafana-opensearch-datasource",
218 + "uid": "replace_datasource_uid"
219 + },
220 + "fieldConfig": {
221 + "defaults": {
222 + "color": {
223 + "mode": "thresholds"
224 + },
225 + "custom": {
226 + "align": "auto",
227 + "cellOptions": {
228 + "type": "auto"
229 + },
230 + "inspect": false
231 + },
232 + "mappings": [],
233 + "thresholds": {
234 + "mode": "absolute",
235 + "steps": [
236 + {
237 + "color": "green",
238 + "value": null
239 + },
240 + {
241 + "color": "red",
242 + "value": 80
243 + }
244 + ]
245 + }
246 + },
247 + "overrides": [
248 + {
249 + "matcher": {
250 + "id": "byName",
251 + "options": "source"
252 + },
253 + "properties": [
254 + {
255 + "id": "custom.width",
256 + "value": 473
257 + }
258 + ]
259 + }
260 + ]
261 + },
262 + "gridPos": {
263 + "h": 8,
264 + "w": 7,
265 + "x": 9,
266 + "y": 0
267 + },
268 + "id": 5,
269 + "options": {
270 + "cellHeight": "sm",
271 + "footer": {
272 + "countRows": false,
273 + "fields": "",
274 + "reducer": [
275 + "sum"
276 + ],
277 + "show": false
278 + },
279 + "showHeader": true,
280 + "sortBy": []
281 + },
282 + "pluginVersion": "10.4.1",
283 + "targets": [
284 + {
285 + "alias": "",
286 + "bucketAggs": [
287 + {
288 + "field": "fw",
289 + "id": "3",
290 + "settings": {
291 + "min_doc_count": "1",
292 + "order": "desc",
293 + "orderBy": "_count",
294 + "size": "20"
295 + },
296 + "type": "terms"
297 + }
298 + ],
299 + "datasource": {
300 + "type": "grafana-opensearch-datasource",
301 + "uid": "replace_datasource_uid"
302 + },
303 + "metrics": [
304 + {
305 + "id": "1",
306 + "type": "count"
307 + }
308 + ],
309 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
310 + "refId": "A",
311 + "timeField": "timestamp"
312 + }
313 + ],
314 + "title": "LOGS BY FIREWALL",
315 + "transformations": [
316 + {
317 + "id": "organize",
318 + "options": {
319 + "excludeByName": {},
320 + "indexByName": {},
321 + "renameByName": {
322 + "devname": "FIREWALL",
323 + "fw": "FIREWALL"
324 + }
325 + }
326 + }
327 + ],
328 + "transparent": true,
329 + "type": "table"
330 + },
331 + {
332 + "datasource": {
333 + "type": "grafana-opensearch-datasource",
334 + "uid": "replace_datasource_uid"
335 + },
336 + "fieldConfig": {
337 + "defaults": {
338 + "color": {
339 + "mode": "palette-classic"
340 + },
341 + "custom": {
342 + "hideFrom": {
343 + "legend": false,
344 + "tooltip": false,
345 + "viz": false
346 + }
347 + },
348 + "mappings": []
349 + },
350 + "overrides": []
351 + },
352 + "gridPos": {
353 + "h": 8,
354 + "w": 8,
355 + "x": 16,
356 + "y": 0
357 + },
358 + "id": 18,
359 + "options": {
360 + "legend": {
361 + "displayMode": "table",
362 + "placement": "right",
363 + "showLegend": true
364 + },
365 + "pieType": "donut",
366 + "reduceOptions": {
367 + "calcs": [
368 + "sum"
369 + ],
370 + "fields": "",
371 + "values": false
372 + },
373 + "tooltip": {
374 + "mode": "single",
375 + "sort": "none"
376 + }
377 + },
378 + "targets": [
379 + {
380 + "alias": "",
381 + "bucketAggs": [
382 + {
383 + "field": "msg_cat",
384 + "id": "3",
385 + "settings": {
386 + "min_doc_count": "1",
387 + "order": "desc",
388 + "orderBy": "_count",
389 + "size": "10"
390 + },
391 + "type": "terms"
392 + },
393 + {
394 + "field": "timestamp",
395 + "id": "2",
396 + "settings": {
397 + "interval": "auto"
398 + },
399 + "type": "date_histogram"
400 + }
401 + ],
402 + "datasource": {
403 + "type": "grafana-opensearch-datasource",
404 + "uid": "replace_datasource_uid"
405 + },
406 + "metrics": [
407 + {
408 + "id": "1",
409 + "type": "count"
410 + }
411 + ],
412 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
413 + "refId": "A",
414 + "timeField": "timestamp"
415 + }
416 + ],
417 + "title": "EVENTS BY CAT (Top 10)",
418 + "type": "piechart"
419 + },
420 + {
421 + "datasource": {
422 + "type": "grafana-opensearch-datasource",
423 + "uid": "replace_datasource_uid"
424 + },
425 + "fieldConfig": {
426 + "defaults": {
427 + "color": {
428 + "mode": "thresholds"
429 + },
430 + "mappings": [],
431 + "thresholds": {
432 + "mode": "absolute",
433 + "steps": [
434 + {
435 + "color": "green",
436 + "value": null
437 + },
438 + {
439 + "color": "red",
440 + "value": 80
441 + }
442 + ]
443 + }
444 + },
445 + "overrides": []
446 + },
447 + "gridPos": {
448 + "h": 8,
449 + "w": 10,
450 + "x": 0,
451 + "y": 8
452 + },
453 + "id": 23,
454 + "options": {
455 + "displayMode": "gradient",
456 + "maxVizHeight": 300,
457 + "minVizHeight": 10,
458 + "minVizWidth": 0,
459 + "namePlacement": "auto",
460 + "orientation": "horizontal",
461 + "reduceOptions": {
462 + "calcs": [
463 + "sum"
464 + ],
465 + "fields": "",
466 + "values": false
467 + },
468 + "showUnfilled": true,
469 + "sizing": "auto",
470 + "valueMode": "color"
471 + },
472 + "pluginVersion": "10.4.1",
473 + "targets": [
474 + {
475 + "alias": "",
476 + "bucketAggs": [
477 + {
478 + "field": "src_ip",
479 + "id": "4",
480 + "settings": {
481 + "min_doc_count": "1",
482 + "order": "desc",
483 + "orderBy": "_count",
484 + "size": "10"
485 + },
486 + "type": "terms"
487 + },
488 + {
489 + "field": "timestamp",
490 + "id": "2",
491 + "settings": {
492 + "interval": "auto"
493 + },
494 + "type": "date_histogram"
495 + }
496 + ],
497 + "datasource": {
498 + "type": "grafana-opensearch-datasource",
499 + "uid": "replace_datasource_uid"
500 + },
501 + "metrics": [
502 + {
503 + "id": "3",
504 + "type": "count"
505 + }
506 + ],
507 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
508 + "refId": "A",
509 + "timeField": "timestamp"
510 + }
511 + ],
512 + "title": "SRC IP (Top 10)",
513 + "type": "bargauge"
514 + },
515 + {
516 + "datasource": {
517 + "type": "grafana-opensearch-datasource",
518 + "uid": "replace_datasource_uid"
519 + },
520 + "fieldConfig": {
521 + "defaults": {
522 + "color": {
523 + "mode": "thresholds"
524 + },
525 + "custom": {
526 + "hideFrom": {
527 + "legend": false,
528 + "tooltip": false,
529 + "viz": false
530 + }
531 + },
532 + "mappings": [],
533 + "thresholds": {
534 + "mode": "absolute",
535 + "steps": [
536 + {
537 + "color": "rgba(245, 54, 54, 0.9)",
538 + "value": null
539 + },
540 + {
541 + "color": "rgba(237, 129, 40, 0.89)",
542 + "value": 0
543 + },
544 + {
545 + "color": "rgba(50, 172, 45, 0.97)",
546 + "value": 10
547 + }
548 + ]
549 + }
550 + },
551 + "overrides": []
552 + },
553 + "gridPos": {
554 + "h": 8,
555 + "w": 8,
556 + "x": 10,
557 + "y": 8
558 + },
559 + "id": 20,
560 + "maxDataPoints": 1,
561 + "options": {
562 + "basemap": {
563 + "name": "Basemap",
564 + "type": "default"
565 + },
566 + "controls": {
567 + "mouseWheelZoom": false,
568 + "showAttribution": true,
569 + "showDebug": false,
570 + "showMeasure": false,
571 + "showScale": false,
572 + "showZoom": true
573 + },
574 + "layers": [
575 + {
576 + "config": {
577 + "showLegend": true,
578 + "style": {
579 + "color": {
580 + "fixed": "dark-green"
581 + },
582 + "opacity": 0.4,
583 + "rotation": {
584 + "fixed": 0,
585 + "max": 360,
586 + "min": -360,
587 + "mode": "mod"
588 + },
589 + "size": {
590 + "fixed": 5,
591 + "max": 30,
592 + "min": 2
593 + },
594 + "symbol": {
595 + "fixed": "img/icons/marker/circle.svg",
596 + "mode": "fixed"
597 + },
598 + "symbolAlign": {
599 + "horizontal": "center",
600 + "vertical": "center"
601 + },
602 + "textConfig": {
603 + "fontSize": 12,
604 + "offsetX": 0,
605 + "offsetY": 0,
606 + "textAlign": "center",
607 + "textBaseline": "middle"
608 + }
609 + }
610 + },
611 + "location": {
612 + "gazetteer": "public/gazetteer/countries.json",
613 + "mode": "lookup"
614 + },
615 + "name": "Layer 0",
616 + "tooltip": true,
617 + "type": "markers"
618 + }
619 + ],
620 + "tooltip": {
621 + "mode": "details"
622 + },
623 + "view": {
624 + "allLayers": true,
625 + "id": "zero",
626 + "lat": 0,
627 + "lon": 0,
628 + "zoom": 1
629 + }
630 + },
631 + "pluginVersion": "10.4.1",
632 + "targets": [
633 + {
634 + "bucketAggs": [
635 + {
636 + "fake": true,
637 + "field": "src_ip_country_code",
638 + "id": "3",
639 + "settings": {
640 + "min_doc_count": 1,
641 + "order": "desc",
642 + "orderBy": "_count",
643 + "size": "20"
644 + },
645 + "type": "terms"
646 + },
647 + {
648 + "field": "timestamp",
649 + "id": "2",
650 + "settings": {
651 + "interval": "auto",
652 + "min_doc_count": 0,
653 + "trimEdges": 0
654 + },
655 + "type": "date_histogram"
656 + }
657 + ],
658 + "datasource": {
659 + "type": "grafana-opensearch-datasource",
660 + "uid": "replace_datasource_uid"
661 + },
662 + "metrics": [
663 + {
664 + "field": "select field",
665 + "id": "1",
666 + "type": "count"
667 + }
668 + ],
669 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
670 + "refId": "A",
671 + "timeField": "timestamp"
672 + }
673 + ],
674 + "title": "SRC GEOIP",
675 + "transformations": [
676 + {
677 + "id": "reduce",
678 + "options": {
679 + "reducers": [
680 + "sum"
681 + ]
682 + }
683 + }
684 + ],
685 + "type": "geomap"
686 + },
687 + {
688 + "datasource": {
689 + "type": "grafana-opensearch-datasource",
690 + "uid": "replace_datasource_uid"
691 + },
692 + "fieldConfig": {
693 + "defaults": {
694 + "color": {
695 + "mode": "thresholds"
696 + },
697 + "custom": {
698 + "align": "auto",
699 + "cellOptions": {
700 + "type": "auto"
701 + },
702 + "inspect": false
703 + },
704 + "mappings": [],
705 + "thresholds": {
706 + "mode": "absolute",
707 + "steps": [
708 + {
709 + "color": "green",
710 + "value": null
711 + },
712 + {
713 + "color": "red",
714 + "value": 80
715 + }
716 + ]
717 + }
718 + },
719 + "overrides": [
720 + {
721 + "matcher": {
722 + "id": "byName",
723 + "options": "source"
724 + },
725 + "properties": [
726 + {
727 + "id": "custom.width",
728 + "value": 473
729 + }
730 + ]
731 + }
732 + ]
733 + },
734 + "gridPos": {
735 + "h": 8,
736 + "w": 6,
737 + "x": 18,
738 + "y": 8
739 + },
740 + "id": 24,
741 + "options": {
742 + "cellHeight": "sm",
743 + "footer": {
744 + "countRows": false,
745 + "fields": "",
746 + "reducer": [
747 + "sum"
748 + ],
749 + "show": false
750 + },
751 + "showHeader": true,
752 + "sortBy": []
753 + },
754 + "pluginVersion": "10.4.1",
755 + "targets": [
756 + {
757 + "alias": "",
758 + "bucketAggs": [
759 + {
760 + "field": "src_ip",
761 + "id": "3",
762 + "settings": {
763 + "min_doc_count": "1",
764 + "order": "desc",
765 + "orderBy": "_count",
766 + "size": "20"
767 + },
768 + "type": "terms"
769 + },
770 + {
771 + "field": "src_ip_country_code",
772 + "id": "4",
773 + "settings": {
774 + "min_doc_count": "1",
775 + "order": "desc",
776 + "orderBy": "_count",
777 + "size": "20"
778 + },
779 + "type": "terms"
780 + }
781 + ],
782 + "datasource": {
783 + "type": "grafana-opensearch-datasource",
784 + "uid": "replace_datasource_uid"
785 + },
786 + "metrics": [
787 + {
788 + "id": "1",
789 + "type": "count"
790 + }
791 + ],
792 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
793 + "refId": "A",
794 + "timeField": "timestamp"
795 + }
796 + ],
797 + "title": "SRC IP AND COUNTRY",
798 + "transformations": [
799 + {
800 + "id": "organize",
801 + "options": {
802 + "excludeByName": {},
803 + "indexByName": {},
804 + "renameByName": {
805 + "devname": "FIREWALL",
806 + "fw": "FIREWALL"
807 + }
808 + }
809 + }
810 + ],
811 + "transparent": true,
812 + "type": "table"
813 + },
814 + {
815 + "datasource": {
816 + "type": "grafana-opensearch-datasource",
817 + "uid": "replace_datasource_uid"
818 + },
819 + "fieldConfig": {
820 + "defaults": {
821 + "color": {
822 + "mode": "palette-classic"
823 + },
824 + "custom": {
825 + "hideFrom": {
826 + "legend": false,
827 + "tooltip": false,
828 + "viz": false
829 + }
830 + },
831 + "mappings": []
832 + },
833 + "overrides": [
834 + {
835 + "matcher": {
836 + "id": "byName",
837 + "options": "INFO"
838 + },
839 + "properties": [
840 + {
841 + "id": "color",
842 + "value": {
843 + "fixedColor": "blue",
844 + "mode": "fixed"
845 + }
846 + }
847 + ]
848 + },
849 + {
850 + "matcher": {
851 + "id": "byName",
852 + "options": "Alert"
853 + },
854 + "properties": [
855 + {
856 + "id": "color",
857 + "value": {
858 + "fixedColor": "light-red",
859 + "mode": "fixed"
860 + }
861 + }
862 + ]
863 + },
864 + {
865 + "matcher": {
866 + "id": "byName",
867 + "options": "Notice"
868 + },
869 + "properties": [
870 + {
871 + "id": "color",
872 + "value": {
873 + "fixedColor": "light-blue",
874 + "mode": "fixed"
875 + }
876 + }
877 + ]
878 + },
879 + {
880 + "matcher": {
881 + "id": "byName",
882 + "options": "Warning"
883 + },
884 + "properties": [
885 + {
886 + "id": "color",
887 + "value": {
888 + "fixedColor": "orange",
889 + "mode": "fixed"
890 + }
891 + }
892 + ]
893 + },
894 + {
895 + "matcher": {
896 + "id": "byName",
897 + "options": "Error"
898 + },
899 + "properties": [
900 + {
901 + "id": "color",
902 + "value": {
903 + "fixedColor": "super-light-red",
904 + "mode": "fixed"
905 + }
906 + }
907 + ]
908 + }
909 + ]
910 + },
911 + "gridPos": {
912 + "h": 8,
913 + "w": 6,
914 + "x": 0,
915 + "y": 16
916 + },
917 + "id": 8,
918 + "options": {
919 + "legend": {
920 + "displayMode": "table",
921 + "placement": "right",
922 + "showLegend": true
923 + },
924 + "pieType": "donut",
925 + "reduceOptions": {
926 + "calcs": [
927 + "sum"
928 + ],
929 + "fields": "",
930 + "values": false
931 + },
932 + "tooltip": {
933 + "mode": "single",
934 + "sort": "none"
935 + }
936 + },
937 + "targets": [
938 + {
939 + "alias": "",
940 + "bucketAggs": [
941 + {
942 + "field": "syslog_level",
943 + "id": "3",
944 + "settings": {
945 + "min_doc_count": "1",
946 + "order": "desc",
947 + "orderBy": "_count",
948 + "size": "15"
949 + },
950 + "type": "terms"
951 + },
952 + {
953 + "field": "timestamp",
954 + "id": "2",
955 + "settings": {
956 + "interval": "auto"
957 + },
958 + "type": "date_histogram"
959 + }
960 + ],
961 + "datasource": {
962 + "type": "grafana-opensearch-datasource",
963 + "uid": "replace_datasource_uid"
964 + },
965 + "metrics": [
966 + {
967 + "id": "1",
968 + "type": "count"
969 + }
970 + ],
971 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
972 + "refId": "A",
973 + "timeField": "timestamp"
974 + }
975 + ],
976 + "title": "LOGS BY SEVERITY",
977 + "type": "piechart"
978 + },
979 + {
980 + "datasource": {
981 + "type": "grafana-opensearch-datasource",
982 + "uid": "replace_datasource_uid"
983 + },
984 + "fieldConfig": {
985 + "defaults": {
986 + "color": {
987 + "mode": "palette-classic"
988 + },
989 + "custom": {
990 + "axisBorderShow": false,
991 + "axisCenteredZero": false,
992 + "axisColorMode": "text",
993 + "axisLabel": "",
994 + "axisPlacement": "auto",
995 + "barAlignment": 0,
996 + "drawStyle": "bars",
997 + "fillOpacity": 0,
998 + "gradientMode": "none",
999 + "hideFrom": {
1000 + "legend": false,
1001 + "tooltip": false,
1002 + "viz": false
1003 + },
1004 + "insertNulls": false,
1005 + "lineInterpolation": "linear",
1006 + "lineWidth": 1,
1007 + "pointSize": 5,
1008 + "scaleDistribution": {
1009 + "type": "linear"
1010 + },
1011 + "showPoints": "auto",
1012 + "spanNulls": false,
1013 + "stacking": {
1014 + "group": "A",
1015 + "mode": "none"
1016 + },
1017 + "thresholdsStyle": {
1018 + "mode": "off"
1019 + }
1020 + },
1021 + "mappings": [],
1022 + "thresholds": {
1023 + "mode": "absolute",
1024 + "steps": [
1025 + {
1026 + "color": "green",
1027 + "value": null
1028 + },
1029 + {
1030 + "color": "red",
1031 + "value": 80
1032 + }
1033 + ]
1034 + },
1035 + "unit": "short"
1036 + },
1037 + "overrides": []
1038 + },
1039 + "gridPos": {
1040 + "h": 16,
1041 + "w": 18,
1042 + "x": 6,
1043 + "y": 16
1044 + },
1045 + "id": 7,
1046 + "options": {
1047 + "legend": {
1048 + "calcs": [],
1049 + "displayMode": "table",
1050 + "placement": "right",
1051 + "showLegend": true
1052 + },
1053 + "tooltip": {
1054 + "mode": "single",
1055 + "sort": "none"
1056 + }
1057 + },
1058 + "pluginVersion": "8.5.1",
1059 + "targets": [
1060 + {
1061 + "alias": "",
1062 + "bucketAggs": [
1063 + {
1064 + "field": "fw",
1065 + "id": "3",
1066 + "settings": {
1067 + "min_doc_count": "1",
1068 + "order": "desc",
1069 + "orderBy": "_count",
1070 + "size": "20"
1071 + },
1072 + "type": "terms"
1073 + },
1074 + {
1075 + "field": "timestamp",
1076 + "id": "4",
1077 + "settings": {
1078 + "interval": "5m",
1079 + "min_doc_count": "1",
1080 + "timeZone": "utc",
1081 + "trimEdges": "0"
1082 + },
1083 + "type": "date_histogram"
1084 + }
1085 + ],
1086 + "datasource": {
1087 + "type": "grafana-opensearch-datasource",
1088 + "uid": "replace_datasource_uid"
1089 + },
1090 + "metrics": [
1091 + {
1092 + "id": "1",
1093 + "type": "count"
1094 + }
1095 + ],
1096 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
1097 + "refId": "A",
1098 + "timeField": "timestamp"
1099 + }
1100 + ],
1101 + "title": "LOGS BY FIREWALL - HISTOGRAM (TOP 20)",
1102 + "type": "timeseries"
1103 + },
1104 + {
1105 + "datasource": {
1106 + "type": "grafana-opensearch-datasource",
1107 + "uid": "replace_datasource_uid"
1108 + },
1109 + "fieldConfig": {
1110 + "defaults": {
1111 + "color": {
1112 + "mode": "palette-classic"
1113 + },
1114 + "custom": {
1115 + "hideFrom": {
1116 + "legend": false,
1117 + "tooltip": false,
1118 + "viz": false
1119 + }
1120 + },
1121 + "mappings": []
1122 + },
1123 + "overrides": [
1124 + {
1125 + "matcher": {
1126 + "id": "byName",
1127 + "options": "information"
1128 + },
1129 + "properties": [
1130 + {
1131 + "id": "color",
1132 + "value": {
1133 + "fixedColor": "blue",
1134 + "mode": "fixed"
1135 + }
1136 + }
1137 + ]
1138 + },
1139 + {
1140 + "matcher": {
1141 + "id": "byName",
1142 + "options": "notice"
1143 + },
1144 + "properties": [
1145 + {
1146 + "id": "color",
1147 + "value": {
1148 + "fixedColor": "green",
1149 + "mode": "fixed"
1150 + }
1151 + }
1152 + ]
1153 + },
1154 + {
1155 + "matcher": {
1156 + "id": "byName",
1157 + "options": "warning"
1158 + },
1159 + "properties": [
1160 + {
1161 + "id": "color",
1162 + "value": {
1163 + "fixedColor": "orange",
1164 + "mode": "fixed"
1165 + }
1166 + }
1167 + ]
1168 + },
1169 + {
1170 + "matcher": {
1171 + "id": "byName",
1172 + "options": "alert"
1173 + },
1174 + "properties": [
1175 + {
1176 + "id": "color",
1177 + "value": {
1178 + "fixedColor": "red",
1179 + "mode": "fixed"
1180 + }
1181 + }
1182 + ]
1183 + },
1184 + {
1185 + "matcher": {
1186 + "id": "byName",
1187 + "options": "block-url"
1188 + },
1189 + "properties": [
1190 + {
1191 + "id": "color",
1192 + "value": {
1193 + "fixedColor": "orange",
1194 + "mode": "fixed"
1195 + }
1196 + }
1197 + ]
1198 + },
1199 + {
1200 + "matcher": {
1201 + "id": "byName",
1202 + "options": "passthrough"
1203 + },
1204 + "properties": [
1205 + {
1206 + "id": "color",
1207 + "value": {
1208 + "fixedColor": "green",
1209 + "mode": "fixed"
1210 + }
1211 + }
1212 + ]
1213 + },
1214 + {
1215 + "matcher": {
1216 + "id": "byName",
1217 + "options": "NA"
1218 + },
1219 + "properties": [
1220 + {
1221 + "id": "color",
1222 + "value": {
1223 + "fixedColor": "orange",
1224 + "mode": "fixed"
1225 + }
1226 + }
1227 + ]
1228 + },
1229 + {
1230 + "matcher": {
1231 + "id": "byName",
1232 + "options": "drop"
1233 + },
1234 + "properties": [
1235 + {
1236 + "id": "color",
1237 + "value": {
1238 + "fixedColor": "red",
1239 + "mode": "fixed"
1240 + }
1241 + }
1242 + ]
1243 + },
1244 + {
1245 + "matcher": {
1246 + "id": "byName",
1247 + "options": "forward"
1248 + },
1249 + "properties": [
1250 + {
1251 + "id": "color",
1252 + "value": {
1253 + "fixedColor": "green",
1254 + "mode": "fixed"
1255 + }
1256 + }
1257 + ]
1258 + },
1259 + {
1260 + "matcher": {
1261 + "id": "byName",
1262 + "options": "mgmt"
1263 + },
1264 + "properties": [
1265 + {
1266 + "id": "color",
1267 + "value": {
1268 + "fixedColor": "blue",
1269 + "mode": "fixed"
1270 + }
1271 + }
1272 + ]
1273 + }
1274 + ]
1275 + },
1276 + "gridPos": {
1277 + "h": 8,
1278 + "w": 6,
1279 + "x": 0,
1280 + "y": 24
1281 + },
1282 + "id": 12,
1283 + "options": {
1284 + "legend": {
1285 + "displayMode": "table",
1286 + "placement": "right",
1287 + "showLegend": true
1288 + },
1289 + "pieType": "donut",
1290 + "reduceOptions": {
1291 + "calcs": [
1292 + "sum"
1293 + ],
1294 + "fields": "",
1295 + "values": false
1296 + },
1297 + "tooltip": {
1298 + "mode": "single",
1299 + "sort": "none"
1300 + }
1301 + },
1302 + "targets": [
1303 + {
1304 + "alias": "",
1305 + "bucketAggs": [
1306 + {
1307 + "field": "fw_action",
1308 + "id": "3",
1309 + "settings": {
1310 + "min_doc_count": "1",
1311 + "order": "desc",
1312 + "orderBy": "_count",
1313 + "size": "15"
1314 + },
1315 + "type": "terms"
1316 + },
1317 + {
1318 + "field": "timestamp",
1319 + "id": "2",
1320 + "settings": {
1321 + "interval": "auto"
1322 + },
1323 + "type": "date_histogram"
1324 + }
1325 + ],
1326 + "datasource": {
1327 + "type": "grafana-opensearch-datasource",
1328 + "uid": "replace_datasource_uid"
1329 + },
1330 + "metrics": [
1331 + {
1332 + "id": "1",
1333 + "type": "count"
1334 + }
1335 + ],
1336 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
1337 + "refId": "A",
1338 + "timeField": "timestamp"
1339 + }
1340 + ],
1341 + "title": "TRAFFIC LOGS BY ACTION",
1342 + "type": "piechart"
1343 + },
1344 + {
1345 + "datasource": {
1346 + "type": "grafana-opensearch-datasource",
1347 + "uid": "replace_datasource_uid"
1348 + },
1349 + "fieldConfig": {
1350 + "defaults": {
1351 + "color": {
1352 + "mode": "palette-classic"
1353 + },
1354 + "custom": {
1355 + "hideFrom": {
1356 + "legend": false,
1357 + "tooltip": false,
1358 + "viz": false
1359 + }
1360 + },
1361 + "mappings": []
1362 + },
1363 + "overrides": []
1364 + },
1365 + "gridPos": {
1366 + "h": 8,
1367 + "w": 6,
1368 + "x": 0,
1369 + "y": 32
1370 + },
1371 + "id": 17,
1372 + "options": {
1373 + "legend": {
1374 + "displayMode": "list",
1375 + "placement": "right",
1376 + "showLegend": false
1377 + },
1378 + "pieType": "pie",
1379 + "reduceOptions": {
1380 + "calcs": [
1381 + "sum"
1382 + ],
1383 + "fields": "",
1384 + "values": false
1385 + },
1386 + "tooltip": {
1387 + "mode": "single",
1388 + "sort": "none"
1389 + }
1390 + },
1391 + "targets": [
1392 + {
1393 + "alias": "",
1394 + "bucketAggs": [
1395 + {
1396 + "field": "msg_cat",
1397 + "id": "3",
1398 + "settings": {
1399 + "min_doc_count": "1",
1400 + "order": "desc",
1401 + "orderBy": "_count",
1402 + "size": "15"
1403 + },
1404 + "type": "terms"
1405 + },
1406 + {
1407 + "field": "timestamp",
1408 + "id": "2",
1409 + "settings": {
1410 + "interval": "auto"
1411 + },
1412 + "type": "date_histogram"
1413 + }
1414 + ],
1415 + "datasource": {
1416 + "type": "grafana-opensearch-datasource",
1417 + "uid": "replace_datasource_uid"
1418 + },
1419 + "metrics": [
1420 + {
1421 + "id": "1",
1422 + "type": "count"
1423 + }
1424 + ],
1425 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
1426 + "refId": "A",
1427 + "timeField": "timestamp"
1428 + }
1429 + ],
1430 + "title": "LOGS BY RULE DESCRIPTION (Top 15)",
1431 + "type": "piechart"
1432 + },
1433 + {
1434 + "datasource": {
1435 + "type": "grafana-opensearch-datasource",
1436 + "uid": "replace_datasource_uid"
1437 + },
1438 + "fieldConfig": {
1439 + "defaults": {
1440 + "color": {
1441 + "mode": "thresholds"
1442 + },
1443 + "custom": {
1444 + "align": "auto",
1445 + "cellOptions": {
1446 + "type": "auto"
1447 + },
1448 + "inspect": false
1449 + },
1450 + "mappings": [],
1451 + "thresholds": {
1452 + "mode": "absolute",
1453 + "steps": [
1454 + {
1455 + "color": "green"
1456 + },
1457 + {
1458 + "color": "red",
1459 + "value": 80
1460 + }
1461 + ]
1462 + }
1463 + },
1464 + "overrides": [
1465 + {
1466 + "matcher": {
1467 + "id": "byName",
1468 + "options": "source"
1469 + },
1470 + "properties": [
1471 + {
1472 + "id": "custom.width",
1473 + "value": 473
1474 + }
1475 + ]
1476 + },
1477 + {
1478 + "matcher": {
1479 + "id": "byName",
1480 + "options": "USER ACCOUNT"
1481 + },
1482 + "properties": [
1483 + {
1484 + "id": "custom.width",
1485 + "value": 422
1486 + }
1487 + ]
1488 + },
1489 + {
1490 + "matcher": {
1491 + "id": "byName",
1492 + "options": "INDICATOR"
1493 + },
1494 + "properties": [
1495 + {
1496 + "id": "custom.width",
1497 + "value": 439
1498 + }
1499 + ]
1500 + },
1501 + {
1502 + "matcher": {
1503 + "id": "byName",
1504 + "options": "msg_detail"
1505 + },
1506 + "properties": [
1507 + {
1508 + "id": "custom.width",
1509 + "value": 796
1510 + }
1511 + ]
1512 + },
1513 + {
1514 + "matcher": {
1515 + "id": "byName",
1516 + "options": "note"
1517 + },
1518 + "properties": [
1519 + {
1520 + "id": "custom.width",
1521 + "value": 925
1522 + }
1523 + ]
1524 + },
1525 + {
1526 + "matcher": {
1527 + "id": "byName",
1528 + "options": "MSG CATEGORY"
1529 + },
1530 + "properties": [
1531 + {
1532 + "id": "custom.width",
1533 + "value": 506
1534 + }
1535 + ]
1536 + }
1537 + ]
1538 + },
1539 + "gridPos": {
1540 + "h": 8,
1541 + "w": 9,
1542 + "x": 6,
1543 + "y": 32
1544 + },
1545 + "id": 14,
1546 + "options": {
1547 + "cellHeight": "sm",
1548 + "footer": {
1549 + "countRows": false,
1550 + "fields": "",
1551 + "reducer": [
1552 + "sum"
1553 + ],
1554 + "show": false
1555 + },
1556 + "showHeader": true,
1557 + "sortBy": []
1558 + },
1559 + "pluginVersion": "10.4.1",
1560 + "targets": [
1561 + {
1562 + "alias": "",
1563 + "bucketAggs": [
1564 + {
1565 + "field": "msg_cat",
1566 + "id": "3",
1567 + "settings": {
1568 + "min_doc_count": "1",
1569 + "order": "desc",
1570 + "orderBy": "_count",
1571 + "size": "0"
1572 + },
1573 + "type": "terms"
1574 + }
1575 + ],
1576 + "datasource": {
1577 + "type": "grafana-opensearch-datasource",
1578 + "uid": "replace_datasource_uid"
1579 + },
1580 + "metrics": [
1581 + {
1582 + "id": "1",
1583 + "type": "count"
1584 + }
1585 + ],
1586 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
1587 + "refId": "A",
1588 + "timeField": "timestamp"
1589 + }
1590 + ],
1591 + "title": "LOGS BY RULE DESCRIPTION (Top 15)",
1592 + "transformations": [
1593 + {
1594 + "id": "organize",
1595 + "options": {
1596 + "excludeByName": {},
1597 + "indexByName": {},
1598 + "renameByName": {
1599 + "msg": "INDICATOR",
1600 + "msg_cat": "MSG CATEGORY",
1601 + "user": "USER ACCOUNT"
1602 + }
1603 + }
1604 + }
1605 + ],
1606 + "transparent": true,
1607 + "type": "table"
1608 + },
1609 + {
1610 + "datasource": {
1611 + "type": "grafana-opensearch-datasource",
1612 + "uid": "replace_datasource_uid"
1613 + },
1614 + "fieldConfig": {
1615 + "defaults": {
1616 + "color": {
1617 + "mode": "thresholds"
1618 + },
1619 + "custom": {
1620 + "align": "auto",
1621 + "cellOptions": {
1622 + "type": "auto"
1623 + },
1624 + "inspect": false
1625 + },
1626 + "mappings": [],
1627 + "thresholds": {
1628 + "mode": "absolute",
1629 + "steps": [
1630 + {
1631 + "color": "green"
1632 + },
1633 + {
1634 + "color": "red",
1635 + "value": 80
1636 + }
1637 + ]
1638 + }
1639 + },
1640 + "overrides": [
1641 + {
1642 + "matcher": {
1643 + "id": "byName",
1644 + "options": "source"
1645 + },
1646 + "properties": [
1647 + {
1648 + "id": "custom.width",
1649 + "value": 473
1650 + }
1651 + ]
1652 + },
1653 + {
1654 + "matcher": {
1655 + "id": "byName",
1656 + "options": "USER ACCOUNT"
1657 + },
1658 + "properties": [
1659 + {
1660 + "id": "custom.width",
1661 + "value": 422
1662 + }
1663 + ]
1664 + },
1665 + {
1666 + "matcher": {
1667 + "id": "byName",
1668 + "options": "INDICATOR"
1669 + },
1670 + "properties": [
1671 + {
1672 + "id": "custom.width",
1673 + "value": 439
1674 + }
1675 + ]
1676 + },
1677 + {
1678 + "matcher": {
1679 + "id": "byName",
1680 + "options": "msg_detail"
1681 + },
1682 + "properties": [
1683 + {
1684 + "id": "custom.width",
1685 + "value": 796
1686 + }
1687 + ]
1688 + },
1689 + {
1690 + "matcher": {
1691 + "id": "byName",
1692 + "options": "note"
1693 + },
1694 + "properties": [
1695 + {
1696 + "id": "custom.width",
1697 + "value": 925
1698 + }
1699 + ]
1700 + },
1701 + {
1702 + "matcher": {
1703 + "id": "byName",
1704 + "options": "MSG CATEGORY"
1705 + },
1706 + "properties": [
1707 + {
1708 + "id": "custom.width",
1709 + "value": 506
1710 + }
1711 + ]
1712 + }
1713 + ]
1714 + },
1715 + "gridPos": {
1716 + "h": 8,
1717 + "w": 9,
1718 + "x": 15,
1719 + "y": 32
1720 + },
1721 + "id": 25,
1722 + "options": {
1723 + "cellHeight": "sm",
1724 + "footer": {
1725 + "countRows": false,
1726 + "fields": "",
1727 + "reducer": [
1728 + "sum"
1729 + ],
1730 + "show": false
1731 + },
1732 + "showHeader": true,
1733 + "sortBy": []
1734 + },
1735 + "pluginVersion": "10.4.1",
1736 + "targets": [
1737 + {
1738 + "alias": "",
1739 + "bucketAggs": [
1740 + {
1741 + "field": "usr",
1742 + "id": "3",
1743 + "settings": {
1744 + "min_doc_count": "1",
1745 + "order": "desc",
1746 + "orderBy": "_count",
1747 + "size": "0"
1748 + },
1749 + "type": "terms"
1750 + }
1751 + ],
1752 + "datasource": {
1753 + "type": "grafana-opensearch-datasource",
1754 + "uid": "replace_datasource_uid"
1755 + },
1756 + "metrics": [
1757 + {
1758 + "id": "1",
1759 + "type": "count"
1760 + }
1761 + ],
1762 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
1763 + "refId": "A",
1764 + "timeField": "timestamp"
1765 + }
1766 + ],
1767 + "title": "LOGS BY USER ACCOUNT (Top 15)",
1768 + "transformations": [
1769 + {
1770 + "id": "organize",
1771 + "options": {
1772 + "excludeByName": {},
1773 + "indexByName": {},
1774 + "renameByName": {
1775 + "msg": "INDICATOR",
1776 + "msg_cat": "MSG CATEGORY",
1777 + "user": "USER ACCOUNT"
1778 + }
1779 + }
1780 + }
1781 + ],
1782 + "type": "table"
1783 + },
1784 + {
1785 + "datasource": {
1786 + "type": "grafana-opensearch-datasource",
1787 + "uid": "replace_datasource_uid"
1788 + },
1789 + "fieldConfig": {
1790 + "defaults": {
1791 + "color": {
1792 + "mode": "thresholds"
1793 + },
1794 + "custom": {
1795 + "align": "auto",
1796 + "cellOptions": {
1797 + "type": "auto"
1798 + },
1799 + "inspect": false
1800 + },
1801 + "mappings": [],
1802 + "thresholds": {
1803 + "mode": "absolute",
1804 + "steps": [
1805 + {
1806 + "color": "green"
1807 + },
1808 + {
1809 + "color": "red",
1810 + "value": 80
1811 + }
1812 + ]
1813 + }
1814 + },
1815 + "overrides": [
1816 + {
1817 + "matcher": {
1818 + "id": "byName",
1819 + "options": "FIREWALL"
1820 + },
1821 + "properties": [
1822 + {
1823 + "id": "custom.width",
1824 + "value": 149
1825 + }
1826 + ]
1827 + },
1828 + {
1829 + "matcher": {
1830 + "id": "byName",
1831 + "options": "ACTION"
1832 + },
1833 + "properties": [
1834 + {
1835 + "id": "custom.width",
1836 + "value": 105
1837 + }
1838 + ]
1839 + },
1840 + {
1841 + "matcher": {
1842 + "id": "byName",
1843 + "options": "SEVERITY"
1844 + },
1845 + "properties": [
1846 + {
1847 + "id": "custom.width",
1848 + "value": 109
1849 + },
1850 + {
1851 + "id": "custom.cellOptions",
1852 + "value": {
1853 + "type": "color-text"
1854 + }
1855 + },
1856 + {
1857 + "id": "mappings",
1858 + "value": [
1859 + {
1860 + "options": {
1861 + "Alert": {
1862 + "color": "red",
1863 + "index": 3
1864 + },
1865 + "Critical": {
1866 + "color": "dark-red",
1867 + "index": 4
1868 + },
1869 + "Emergency": {
1870 + "color": "purple",
1871 + "index": 6
1872 + },
1873 + "Error": {
1874 + "color": "red",
1875 + "index": 5
1876 + },
1877 + "Info": {
1878 + "color": "green",
1879 + "index": 1
1880 + },
1881 + "Notice": {
1882 + "color": "blue",
1883 + "index": 0
1884 + },
1885 + "Warning": {
1886 + "color": "orange",
1887 + "index": 2
1888 + }
1889 + },
1890 + "type": "value"
1891 + }
1892 + ]
1893 + }
1894 + ]
1895 + },
1896 + {
1897 + "matcher": {
1898 + "id": "byName",
1899 + "options": "SRC IP"
1900 + },
1901 + "properties": [
1902 + {
1903 + "id": "custom.width",
1904 + "value": 137
1905 + }
1906 + ]
1907 + },
1908 + {
1909 + "matcher": {
1910 + "id": "byName",
1911 + "options": "SRC PORT"
1912 + },
1913 + "properties": [
1914 + {
1915 + "id": "custom.width",
1916 + "value": 87
1917 + }
1918 + ]
1919 + },
1920 + {
1921 + "matcher": {
1922 + "id": "byName",
1923 + "options": "IF IN"
1924 + },
1925 + "properties": [
1926 + {
1927 + "id": "custom.width",
1928 + "value": 110
1929 + }
1930 + ]
1931 + },
1932 + {
1933 + "matcher": {
1934 + "id": "byName",
1935 + "options": "APP"
1936 + },
1937 + "properties": [
1938 + {
1939 + "id": "custom.width",
1940 + "value": 131
1941 + }
1942 + ]
1943 + },
1944 + {
1945 + "matcher": {
1946 + "id": "byName",
1947 + "options": "DST IP"
1948 + },
1949 + "properties": [
1950 + {
1951 + "id": "custom.width",
1952 + "value": 134
1953 + }
1954 + ]
1955 + },
1956 + {
1957 + "matcher": {
1958 + "id": "byName",
1959 + "options": "DST PORT"
1960 + },
1961 + "properties": [
1962 + {
1963 + "id": "custom.width",
1964 + "value": 93
1965 + }
1966 + ]
1967 + },
1968 + {
1969 + "matcher": {
1970 + "id": "byName",
1971 + "options": "EVENT ID"
1972 + },
1973 + "properties": [
1974 + {
1975 + "id": "links",
1976 + "value": [
1977 + {
1978 + "targetBlank": true,
1979 + "title": "EVENT DETAILS",
1980 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SONICWALL%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D"
1981 + }
1982 + ]
1983 + },
1984 + {
1985 + "id": "custom.width",
1986 + "value": 214
1987 + }
1988 + ]
1989 + },
1990 + {
1991 + "matcher": {
1992 + "id": "byName",
1993 + "options": "SERVICE"
1994 + },
1995 + "properties": [
1996 + {
1997 + "id": "custom.width",
1998 + "value": 95
1999 + }
2000 + ]
2001 + },
2002 + {
2003 + "matcher": {
2004 + "id": "byName",
2005 + "options": "DATE/TIME"
2006 + },
2007 + "properties": [
2008 + {
2009 + "id": "custom.width",
2010 + "value": 188
2011 + }
2012 + ]
2013 + },
2014 + {
2015 + "matcher": {
2016 + "id": "byName",
2017 + "options": "PROFILE"
2018 + },
2019 + "properties": [
2020 + {
2021 + "id": "custom.width",
2022 + "value": 234
2023 + }
2024 + ]
2025 + },
2026 + {
2027 + "matcher": {
2028 + "id": "byName",
2029 + "options": "SRC IF"
2030 + },
2031 + "properties": [
2032 + {
2033 + "id": "custom.width",
2034 + "value": 74
2035 + }
2036 + ]
2037 + },
2038 + {
2039 + "matcher": {
2040 + "id": "byName",
2041 + "options": "PROTO"
2042 + },
2043 + "properties": [
2044 + {
2045 + "id": "custom.width",
2046 + "value": 117
2047 + }
2048 + ]
2049 + },
2050 + {
2051 + "matcher": {
2052 + "id": "byName",
2053 + "options": "DST IF"
2054 + },
2055 + "properties": [
2056 + {
2057 + "id": "custom.width",
2058 + "value": 95
2059 + }
2060 + ]
2061 + }
2062 + ]
2063 + },
2064 + "gridPos": {
2065 + "h": 15,
2066 + "w": 24,
2067 + "x": 0,
2068 + "y": 40
2069 + },
2070 + "id": 16,
2071 + "options": {
2072 + "cellHeight": "sm",
2073 + "footer": {
2074 + "countRows": false,
2075 + "fields": "",
2076 + "reducer": [
2077 + "sum"
2078 + ],
2079 + "show": false
2080 + },
2081 + "showHeader": true,
2082 + "sortBy": []
2083 + },
2084 + "pluginVersion": "10.4.1",
2085 + "targets": [
2086 + {
2087 + "alias": "",
2088 + "bucketAggs": [],
2089 + "datasource": {
2090 + "type": "grafana-opensearch-datasource",
2091 + "uid": "replace_datasource_uid"
2092 + },
2093 + "metrics": [
2094 + {
2095 + "id": "1",
2096 + "settings": {
2097 + "size": "500"
2098 + },
2099 + "type": "raw_data"
2100 + }
2101 + ],
2102 + "query": "fw:$firewall AND (m:372 OR m:427 OR m:1080)",
2103 + "refId": "A",
2104 + "timeField": "timestamp"
2105 + }
2106 + ],
2107 + "title": "FIREWALL EVENTS",
2108 + "transformations": [
2109 + {
2110 + "id": "organize",
2111 + "options": {
2112 + "excludeByName": {
2113 + "_index": true,
2114 + "_type": true,
2115 + "alert_category": true,
2116 + "alert_definitions_version": true,
2117 + "alertlight": true,
2118 + "app": true,
2119 + "appName": true,
2120 + "appcat": true,
2121 + "appid": true,
2122 + "arg": true,
2123 + "c": true,
2124 + "cat": true,
2125 + "catdesc": true,
2126 + "category": true,
2127 + "catid": true,
2128 + "code": true,
2129 + "craction": true,
2130 + "crlevel": true,
2131 + "crscore": true,
2132 + "devid": true,
2133 + "direction": true,
2134 + "dpi": true,
2135 + "dst": true,
2136 + "dstMAC": true,
2137 + "dstMac": true,
2138 + "dst_host": false,
2139 + "dst_ip": true,
2140 + "dst_ip_city_name": true,
2141 + "dst_ip_country_code": true,
2142 + "dst_ip_geolocation": true,
2143 + "dstintf": true,
2144 + "dstintfrole": true,
2145 + "dstip": true,
2146 + "dstip_city_name": true,
2147 + "dstip_country_code": true,
2148 + "dstip_geolocation": true,
2149 + "dstname_city_name": true,
2150 + "dstname_country_code": true,
2151 + "dstname_geolocation": true,
2152 + "dstport": true,
2153 + "eventtype": true,
2154 + "facility": true,
2155 + "facility_num": true,
2156 + "fw_city_name": true,
2157 + "fw_country_code": true,
2158 + "fw_geolocation": true,
2159 + "gl2_accounted_message_size": true,
2160 + "gl2_message_id": true,
2161 + "gl2_remote_ip": true,
2162 + "gl2_remote_port": true,
2163 + "gl2_source_input": true,
2164 + "gl2_source_node": true,
2165 + "group": true,
2166 + "highlight": true,
2167 + "hostname": true,
2168 + "hostname_city_name": true,
2169 + "hostname_country_code": true,
2170 + "hostname_geolocation": true,
2171 + "id": true,
2172 + "level": true,
2173 + "logdesc": false,
2174 + "logver": true,
2175 + "m": true,
2176 + "message": true,
2177 + "method": true,
2178 + "msg": false,
2179 + "msg_cat": true,
2180 + "msg_detail": false,
2181 + "n": true,
2182 + "note": true,
2183 + "op": true,
2184 + "policyid": true,
2185 + "pri": true,
2186 + "proto": true,
2187 + "rcvd": true,
2188 + "rcvdbyte": true,
2189 + "reqtype": true,
2190 + "rule": true,
2191 + "sent": true,
2192 + "sentbyte": true,
2193 + "sess": true,
2194 + "sessionid": true,
2195 + "sid": true,
2196 + "sn": true,
2197 + "sort": true,
2198 + "source": true,
2199 + "source_city_name": true,
2200 + "source_country_code": true,
2201 + "source_geolocation": true,
2202 + "src": true,
2203 + "srcMac": true,
2204 + "src_ip_city_name": true,
2205 + "src_ip_country_code": false,
2206 + "src_ip_geolocation": true,
2207 + "srcintf": true,
2208 + "srcintfrole": true,
2209 + "srcip": true,
2210 + "srcip_city_name": true,
2211 + "srcip_country_code": true,
2212 + "srcip_geolocation": true,
2213 + "srcport": true,
2214 + "streams": true,
2215 + "subtype": false,
2216 + "syslog_level": true,
2217 + "syslog_type": true,
2218 + "time": true,
2219 + "type": true,
2220 + "user": true,
2221 + "vd": true
2222 + },
2223 + "indexByName": {
2224 + "_id": 1,
2225 + "_index": 7,
2226 + "_type": 8,
2227 + "c": 42,
2228 + "dst": 18,
2229 + "dst_ip": 19,
2230 + "dst_ip_city_name": 21,
2231 + "dst_ip_country_code": 22,
2232 + "dst_ip_geolocation": 23,
2233 + "facility": 24,
2234 + "facility_num": 25,
2235 + "fw": 2,
2236 + "fw_action": 26,
2237 + "fw_city_name": 27,
2238 + "fw_country_code": 28,
2239 + "fw_geolocation": 29,
2240 + "gl2_accounted_message_size": 9,
2241 + "gl2_message_id": 10,
2242 + "gl2_remote_ip": 11,
2243 + "gl2_remote_port": 12,
2244 + "gl2_source_input": 13,
2245 + "gl2_source_node": 14,
2246 + "highlight": 30,
2247 + "id": 31,
2248 + "level": 32,
2249 + "m": 43,
2250 + "message": 15,
2251 + "msg": 33,
2252 + "msg_cat": 44,
2253 + "msg_detail": 45,
2254 + "n": 46,
2255 + "note": 47,
2256 + "pri": 48,
2257 + "proto": 20,
2258 + "sess": 49,
2259 + "sn": 34,
2260 + "sort": 35,
2261 + "source": 6,
2262 + "source_city_name": 36,
2263 + "source_country_code": 37,
2264 + "source_geolocation": 38,
2265 + "src": 39,
2266 + "src_ip": 4,
2267 + "src_ip_city_name": 40,
2268 + "src_ip_country_code": 5,
2269 + "src_ip_geolocation": 41,
2270 + "streams": 16,
2271 + "syslog_level": 50,
2272 + "syslog_type": 17,
2273 + "time": 51,
2274 + "timestamp": 0,
2275 + "usr": 3
2276 + },
2277 + "renameByName": {
2278 + "Category": "CATEGORY",
2279 + "_id": "EVENT ID",
2280 + "action": "ACTION",
2281 + "alert_signature": "SIGNATURE",
2282 + "app": "APP",
2283 + "destination_location_name": "LOCATION",
2284 + "devname": "FIREWALL",
2285 + "dst_host": "DST HOSTNAME",
2286 + "dst_if": "DST IF",
2287 + "dst_ip": "DST IP",
2288 + "dst_port": "DST PORT",
2289 + "dstip": "DST IP",
2290 + "dstname": "DST NAME",
2291 + "dstport": "DST PORT",
2292 + "event_log_name": "",
2293 + "fw": "FIREWALL",
2294 + "fw_action": "ACTION",
2295 + "http_method": "METHOD",
2296 + "http_user_agent_name": "HTTP AGENT",
2297 + "logdesc": "DESCRIPTION",
2298 + "msg": "MESSAGE",
2299 + "msg_detail": "MSG DETAIL",
2300 + "network_interface_in": "IF IN",
2301 + "network_interface_out": "IF OUT",
2302 + "network_transport": "",
2303 + "profile": "PROFILE",
2304 + "proto": "PROTO",
2305 + "rule_name": "RULE",
2306 + "service": "SERVICE",
2307 + "source": "",
2308 + "source_port": "SRC PORT",
2309 + "src_if": "SRC IF",
2310 + "src_ip": "SRC IP",
2311 + "src_ip_country_code": "COUNTRY",
2312 + "src_port": "SRC PORT",
2313 + "srcip": "SRC IP",
2314 + "subtype": "SUBTYPE",
2315 + "syslog_level": "SEVERITY",
2316 + "timestamp": "DATE/TIME",
2317 + "url": "URL",
2318 + "usr": "ACCOUNT"
2319 + }
2320 + }
2321 + }
2322 + ],
2323 + "transparent": true,
2324 + "type": "table"
2325 + }
2326 + ],
2327 + "schemaVersion": 39,
2328 + "tags": [
2329 + "SONICWALL"
2330 + ],
2331 + "templating": {
2332 + "list": [
2333 + {
2334 + "current": {
2335 + "selected": false,
2336 + "text": "All",
2337 + "value": "$__all"
2338 + },
2339 + "datasource": {
2340 + "type": "grafana-opensearch-datasource",
2341 + "uid": "replace_datasource_uid"
2342 + },
2343 + "definition": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"m:372 OR m:427 OR m:1080\"}",
2344 + "description": "FORTINET FIREWALL",
2345 + "hide": 0,
2346 + "includeAll": true,
2347 + "label": "Firewall",
2348 + "multi": false,
2349 + "name": "firewall",
2350 + "options": [],
2351 + "query": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"m:372 OR m:427 OR m:1080\"}",
2352 + "refresh": 2,
2353 + "regex": "",
2354 + "skipUrlSync": false,
2355 + "sort": 0,
2356 + "type": "query"
2357 + },
2358 + {
2359 + "datasource": {
2360 + "type": "grafana-opensearch-datasource",
2361 + "uid": "replace_datasource_uid"
2362 + },
2363 + "filters": [],
2364 + "hide": 0,
2365 + "name": "Filters",
2366 + "skipUrlSync": false,
2367 + "type": "adhoc"
2368 + }
2369 + ]
2370 + },
2371 + "time": {
2372 + "from": "now-6h",
2373 + "to": "now"
2374 + },
2375 + "timepicker": {},
2376 + "timezone": "",
2377 + "title": "SONICWALL - VPN LOGS",
2378 + "weekStart": ""
2379 +}
backend/app/connectors/grafana/dashboards/Sonicwall/sonicwall_web_control.json new
+2186
@@ -0,0 +1,2186 @@
1 +{
2 + "annotations": {
3 + "list": [
4 + {
5 + "builtIn": 1,
6 + "datasource": {
7 + "type": "grafana",
8 + "uid": "-- Grafana --"
9 + },
10 + "enable": true,
11 + "hide": true,
12 + "iconColor": "rgba(0, 211, 255, 1)",
13 + "name": "Annotations & Alerts",
14 + "target": {
15 + "limit": 100,
16 + "matchAny": false,
17 + "tags": [],
18 + "type": "dashboard"
19 + },
20 + "type": "dashboard"
21 + }
22 + ]
23 + },
24 + "description": "SONICWALL - LOGS SUMMARY",
25 + "editable": false,
26 + "fiscalYearStartMonth": 0,
27 + "graphTooltip": 0,
28 + "id": null,
29 + "links": [
30 + {
31 + "asDropdown": true,
32 + "icon": "external link",
33 + "includeVars": true,
34 + "keepTime": true,
35 + "tags": [
36 + "SONICWALL"
37 + ],
38 + "targetBlank": true,
39 + "title": "SONICWALL DASHBOARDS",
40 + "tooltip": "",
41 + "type": "dashboards",
42 + "url": ""
43 + }
44 + ],
45 + "liveNow": false,
46 + "panels": [
47 + {
48 + "datasource": {
49 + "type": "grafana-opensearch-datasource",
50 + "uid": "replace_datasource_uid"
51 + },
52 + "fieldConfig": {
53 + "defaults": {
54 + "color": {
55 + "mode": "thresholds"
56 + },
57 + "mappings": [],
58 + "thresholds": {
59 + "mode": "absolute",
60 + "steps": [
61 + {
62 + "color": "orange",
63 + "value": null
64 + }
65 + ]
66 + },
67 + "unit": "short"
68 + },
69 + "overrides": []
70 + },
71 + "gridPos": {
72 + "h": 8,
73 + "w": 4,
74 + "x": 0,
75 + "y": 0
76 + },
77 + "id": 2,
78 + "options": {
79 + "colorMode": "value",
80 + "graphMode": "area",
81 + "justifyMode": "auto",
82 + "orientation": "auto",
83 + "reduceOptions": {
84 + "calcs": [
85 + "sum"
86 + ],
87 + "fields": "",
88 + "values": false
89 + },
90 + "showPercentChange": false,
91 + "textMode": "auto",
92 + "wideLayout": true
93 + },
94 + "pluginVersion": "10.4.1",
95 + "targets": [
96 + {
97 + "alias": "",
98 + "bucketAggs": [
99 + {
100 + "field": "timestamp",
101 + "id": "2",
102 + "settings": {
103 + "interval": "auto"
104 + },
105 + "type": "date_histogram"
106 + }
107 + ],
108 + "datasource": {
109 + "type": "grafana-opensearch-datasource",
110 + "uid": "replace_datasource_uid"
111 + },
112 + "metrics": [
113 + {
114 + "id": "1",
115 + "type": "count"
116 + }
117 + ],
118 + "query": "fw:$firewall AND _exists_:Category",
119 + "refId": "A",
120 + "timeField": "timestamp"
121 + }
122 + ],
123 + "title": "WEB CONTROL ALERTS",
124 + "type": "stat"
125 + },
126 + {
127 + "datasource": {
128 + "type": "grafana-opensearch-datasource",
129 + "uid": "replace_datasource_uid"
130 + },
131 + "fieldConfig": {
132 + "defaults": {
133 + "color": {
134 + "mode": "palette-classic"
135 + },
136 + "custom": {
137 + "hideFrom": {
138 + "legend": false,
139 + "tooltip": false,
140 + "viz": false
141 + }
142 + },
143 + "mappings": []
144 + },
145 + "overrides": []
146 + },
147 + "gridPos": {
148 + "h": 8,
149 + "w": 5,
150 + "x": 4,
151 + "y": 0
152 + },
153 + "id": 4,
154 + "options": {
155 + "legend": {
156 + "displayMode": "list",
157 + "placement": "right",
158 + "showLegend": false
159 + },
160 + "pieType": "pie",
161 + "reduceOptions": {
162 + "calcs": [
163 + "sum"
164 + ],
165 + "fields": "",
166 + "values": false
167 + },
168 + "tooltip": {
169 + "mode": "single",
170 + "sort": "none"
171 + }
172 + },
173 + "targets": [
174 + {
175 + "alias": "",
176 + "bucketAggs": [
177 + {
178 + "field": "fw",
179 + "id": "3",
180 + "settings": {
181 + "min_doc_count": "1",
182 + "order": "desc",
183 + "orderBy": "_count",
184 + "size": "15"
185 + },
186 + "type": "terms"
187 + },
188 + {
189 + "field": "timestamp",
190 + "id": "2",
191 + "settings": {
192 + "interval": "auto"
193 + },
194 + "type": "date_histogram"
195 + }
196 + ],
197 + "datasource": {
198 + "type": "grafana-opensearch-datasource",
199 + "uid": "replace_datasource_uid"
200 + },
201 + "metrics": [
202 + {
203 + "id": "1",
204 + "type": "count"
205 + }
206 + ],
207 + "query": "fw:$firewall AND _exists_:Category",
208 + "refId": "A",
209 + "timeField": "timestamp"
210 + }
211 + ],
212 + "title": "ALERTS BY FIREWALL",
213 + "type": "piechart"
214 + },
215 + {
216 + "datasource": {
217 + "type": "grafana-opensearch-datasource",
218 + "uid": "replace_datasource_uid"
219 + },
220 + "fieldConfig": {
221 + "defaults": {
222 + "color": {
223 + "mode": "thresholds"
224 + },
225 + "custom": {
226 + "align": "auto",
227 + "cellOptions": {
228 + "type": "auto"
229 + },
230 + "inspect": false
231 + },
232 + "mappings": [],
233 + "thresholds": {
234 + "mode": "absolute",
235 + "steps": [
236 + {
237 + "color": "green",
238 + "value": null
239 + },
240 + {
241 + "color": "red",
242 + "value": 80
243 + }
244 + ]
245 + }
246 + },
247 + "overrides": [
248 + {
249 + "matcher": {
250 + "id": "byName",
251 + "options": "source"
252 + },
253 + "properties": [
254 + {
255 + "id": "custom.width",
256 + "value": 473
257 + }
258 + ]
259 + }
260 + ]
261 + },
262 + "gridPos": {
263 + "h": 8,
264 + "w": 7,
265 + "x": 9,
266 + "y": 0
267 + },
268 + "id": 5,
269 + "options": {
270 + "cellHeight": "sm",
271 + "footer": {
272 + "countRows": false,
273 + "fields": "",
274 + "reducer": [
275 + "sum"
276 + ],
277 + "show": false
278 + },
279 + "showHeader": true,
280 + "sortBy": []
281 + },
282 + "pluginVersion": "10.4.1",
283 + "targets": [
284 + {
285 + "alias": "",
286 + "bucketAggs": [
287 + {
288 + "field": "fw",
289 + "id": "3",
290 + "settings": {
291 + "min_doc_count": "1",
292 + "order": "desc",
293 + "orderBy": "_count",
294 + "size": "20"
295 + },
296 + "type": "terms"
297 + }
298 + ],
299 + "datasource": {
300 + "type": "grafana-opensearch-datasource",
301 + "uid": "replace_datasource_uid"
302 + },
303 + "metrics": [
304 + {
305 + "id": "1",
306 + "type": "count"
307 + }
308 + ],
309 + "query": "fw:$firewall AND _exists_:Category",
310 + "refId": "A",
311 + "timeField": "timestamp"
312 + }
313 + ],
314 + "title": "LOGS BY FIREWALL",
315 + "transformations": [
316 + {
317 + "id": "organize",
318 + "options": {
319 + "excludeByName": {},
320 + "indexByName": {},
321 + "renameByName": {
322 + "devname": "FIREWALL",
323 + "fw": "FIREWALL"
324 + }
325 + }
326 + }
327 + ],
328 + "transparent": true,
329 + "type": "table"
330 + },
331 + {
332 + "datasource": {
333 + "type": "grafana-opensearch-datasource",
334 + "uid": "replace_datasource_uid"
335 + },
336 + "fieldConfig": {
337 + "defaults": {
338 + "color": {
339 + "mode": "palette-classic"
340 + },
341 + "custom": {
342 + "hideFrom": {
343 + "legend": false,
344 + "tooltip": false,
345 + "viz": false
346 + }
347 + },
348 + "mappings": []
349 + },
350 + "overrides": []
351 + },
352 + "gridPos": {
353 + "h": 8,
354 + "w": 8,
355 + "x": 16,
356 + "y": 0
357 + },
358 + "id": 18,
359 + "options": {
360 + "legend": {
361 + "displayMode": "table",
362 + "placement": "right",
363 + "showLegend": true
364 + },
365 + "pieType": "donut",
366 + "reduceOptions": {
367 + "calcs": [
368 + "sum"
369 + ],
370 + "fields": "",
371 + "values": false
372 + },
373 + "tooltip": {
374 + "mode": "single",
375 + "sort": "none"
376 + }
377 + },
378 + "targets": [
379 + {
380 + "alias": "",
381 + "bucketAggs": [
382 + {
383 + "field": "Category",
384 + "id": "3",
385 + "settings": {
386 + "min_doc_count": "1",
387 + "order": "desc",
388 + "orderBy": "_count",
389 + "size": "10"
390 + },
391 + "type": "terms"
392 + },
393 + {
394 + "field": "timestamp",
395 + "id": "2",
396 + "settings": {
397 + "interval": "auto"
398 + },
399 + "type": "date_histogram"
400 + }
401 + ],
402 + "datasource": {
403 + "type": "grafana-opensearch-datasource",
404 + "uid": "replace_datasource_uid"
405 + },
406 + "metrics": [
407 + {
408 + "id": "1",
409 + "type": "count"
410 + }
411 + ],
412 + "query": "fw:$firewall AND _exists_:Category",
413 + "refId": "A",
414 + "timeField": "timestamp"
415 + }
416 + ],
417 + "title": "ALERTS BY WEB CAT (Top 10)",
418 + "type": "piechart"
419 + },
420 + {
421 + "datasource": {
422 + "type": "grafana-opensearch-datasource",
423 + "uid": "replace_datasource_uid"
424 + },
425 + "fieldConfig": {
426 + "defaults": {
427 + "color": {
428 + "mode": "thresholds"
429 + },
430 + "mappings": [],
431 + "thresholds": {
432 + "mode": "absolute",
433 + "steps": [
434 + {
435 + "color": "green",
436 + "value": null
437 + },
438 + {
439 + "color": "red",
440 + "value": 80
441 + }
442 + ]
443 + }
444 + },
445 + "overrides": []
446 + },
447 + "gridPos": {
448 + "h": 8,
449 + "w": 10,
450 + "x": 0,
451 + "y": 8
452 + },
453 + "id": 23,
454 + "options": {
455 + "displayMode": "gradient",
456 + "maxVizHeight": 300,
457 + "minVizHeight": 10,
458 + "minVizWidth": 0,
459 + "namePlacement": "auto",
460 + "orientation": "horizontal",
461 + "reduceOptions": {
462 + "calcs": [
463 + "sum"
464 + ],
465 + "fields": "",
466 + "values": false
467 + },
468 + "showUnfilled": true,
469 + "sizing": "auto",
470 + "valueMode": "color"
471 + },
472 + "pluginVersion": "10.4.1",
473 + "targets": [
474 + {
475 + "alias": "",
476 + "bucketAggs": [
477 + {
478 + "field": "dst_ip",
479 + "id": "4",
480 + "settings": {
481 + "min_doc_count": "1",
482 + "order": "desc",
483 + "orderBy": "_count",
484 + "size": "10"
485 + },
486 + "type": "terms"
487 + },
488 + {
489 + "field": "timestamp",
490 + "id": "2",
491 + "settings": {
492 + "interval": "auto"
493 + },
494 + "type": "date_histogram"
495 + }
496 + ],
497 + "datasource": {
498 + "type": "grafana-opensearch-datasource",
499 + "uid": "replace_datasource_uid"
500 + },
501 + "metrics": [
502 + {
503 + "id": "3",
504 + "type": "count"
505 + }
506 + ],
507 + "query": "fw:$firewall AND _exists_:Category",
508 + "refId": "A",
509 + "timeField": "timestamp"
510 + }
511 + ],
512 + "title": "DST IP (Top 10)",
513 + "type": "bargauge"
514 + },
515 + {
516 + "datasource": {
517 + "type": "grafana-opensearch-datasource",
518 + "uid": "replace_datasource_uid"
519 + },
520 + "fieldConfig": {
521 + "defaults": {
522 + "color": {
523 + "mode": "thresholds"
524 + },
525 + "custom": {
526 + "hideFrom": {
527 + "legend": false,
528 + "tooltip": false,
529 + "viz": false
530 + }
531 + },
532 + "mappings": [],
533 + "thresholds": {
534 + "mode": "absolute",
535 + "steps": [
536 + {
537 + "color": "rgba(245, 54, 54, 0.9)",
538 + "value": null
539 + },
540 + {
541 + "color": "rgba(237, 129, 40, 0.89)",
542 + "value": 0
543 + },
544 + {
545 + "color": "rgba(50, 172, 45, 0.97)",
546 + "value": 10
547 + }
548 + ]
549 + }
550 + },
551 + "overrides": []
552 + },
553 + "gridPos": {
554 + "h": 8,
555 + "w": 8,
556 + "x": 10,
557 + "y": 8
558 + },
559 + "id": 20,
560 + "maxDataPoints": 1,
561 + "options": {
562 + "basemap": {
563 + "name": "Basemap",
564 + "type": "default"
565 + },
566 + "controls": {
567 + "mouseWheelZoom": false,
568 + "showAttribution": true,
569 + "showDebug": false,
570 + "showMeasure": false,
571 + "showScale": false,
572 + "showZoom": true
573 + },
574 + "layers": [
575 + {
576 + "config": {
577 + "showLegend": true,
578 + "style": {
579 + "color": {
580 + "fixed": "dark-green"
581 + },
582 + "opacity": 0.4,
583 + "rotation": {
584 + "fixed": 0,
585 + "max": 360,
586 + "min": -360,
587 + "mode": "mod"
588 + },
589 + "size": {
590 + "fixed": 5,
591 + "max": 30,
592 + "min": 2
593 + },
594 + "symbol": {
595 + "fixed": "img/icons/marker/circle.svg",
596 + "mode": "fixed"
597 + },
598 + "symbolAlign": {
599 + "horizontal": "center",
600 + "vertical": "center"
601 + },
602 + "textConfig": {
603 + "fontSize": 12,
604 + "offsetX": 0,
605 + "offsetY": 0,
606 + "textAlign": "center",
607 + "textBaseline": "middle"
608 + }
609 + }
610 + },
611 + "location": {
612 + "gazetteer": "public/gazetteer/countries.json",
613 + "mode": "lookup"
614 + },
615 + "name": "Layer 0",
616 + "tooltip": true,
617 + "type": "markers"
618 + }
619 + ],
620 + "tooltip": {
621 + "mode": "details"
622 + },
623 + "view": {
624 + "allLayers": true,
625 + "id": "zero",
626 + "lat": 0,
627 + "lon": 0,
628 + "zoom": 1
629 + }
630 + },
631 + "pluginVersion": "10.4.1",
632 + "targets": [
633 + {
634 + "bucketAggs": [
635 + {
636 + "fake": true,
637 + "field": "dst_ip_country_code",
638 + "id": "3",
639 + "settings": {
640 + "min_doc_count": 1,
641 + "order": "desc",
642 + "orderBy": "_count",
643 + "size": "20"
644 + },
645 + "type": "terms"
646 + },
647 + {
648 + "field": "timestamp",
649 + "id": "2",
650 + "settings": {
651 + "interval": "auto",
652 + "min_doc_count": 0,
653 + "trimEdges": 0
654 + },
655 + "type": "date_histogram"
656 + }
657 + ],
658 + "datasource": {
659 + "type": "grafana-opensearch-datasource",
660 + "uid": "replace_datasource_uid"
661 + },
662 + "metrics": [
663 + {
664 + "field": "select field",
665 + "id": "1",
666 + "type": "count"
667 + }
668 + ],
669 + "query": "fw:$firewall AND _exists_:Category",
670 + "refId": "A",
671 + "timeField": "timestamp"
672 + }
673 + ],
674 + "title": "DST GEOIP",
675 + "transformations": [
676 + {
677 + "id": "reduce",
678 + "options": {
679 + "reducers": [
680 + "sum"
681 + ]
682 + }
683 + }
684 + ],
685 + "type": "geomap"
686 + },
687 + {
688 + "datasource": {
689 + "type": "grafana-opensearch-datasource",
690 + "uid": "replace_datasource_uid"
691 + },
692 + "fieldConfig": {
693 + "defaults": {
694 + "color": {
695 + "mode": "thresholds"
696 + },
697 + "custom": {
698 + "align": "auto",
699 + "cellOptions": {
700 + "type": "auto"
701 + },
702 + "inspect": false
703 + },
704 + "mappings": [],
705 + "thresholds": {
706 + "mode": "absolute",
707 + "steps": [
708 + {
709 + "color": "green",
710 + "value": null
711 + },
712 + {
713 + "color": "red",
714 + "value": 80
715 + }
716 + ]
717 + }
718 + },
719 + "overrides": [
720 + {
721 + "matcher": {
722 + "id": "byName",
723 + "options": "source"
724 + },
725 + "properties": [
726 + {
727 + "id": "custom.width",
728 + "value": 473
729 + }
730 + ]
731 + }
732 + ]
733 + },
734 + "gridPos": {
735 + "h": 8,
736 + "w": 6,
737 + "x": 18,
738 + "y": 8
739 + },
740 + "id": 24,
741 + "options": {
742 + "cellHeight": "sm",
743 + "footer": {
744 + "countRows": false,
745 + "fields": "",
746 + "reducer": [
747 + "sum"
748 + ],
749 + "show": false
750 + },
751 + "showHeader": true,
752 + "sortBy": []
753 + },
754 + "pluginVersion": "10.4.1",
755 + "targets": [
756 + {
757 + "alias": "",
758 + "bucketAggs": [
759 + {
760 + "field": "dst_ip",
761 + "id": "3",
762 + "settings": {
763 + "min_doc_count": "1",
764 + "order": "desc",
765 + "orderBy": "_count",
766 + "size": "20"
767 + },
768 + "type": "terms"
769 + },
770 + {
771 + "field": "dst_ip_country_code",
772 + "id": "4",
773 + "settings": {
774 + "min_doc_count": "1",
775 + "order": "desc",
776 + "orderBy": "_count",
777 + "size": "20"
778 + },
779 + "type": "terms"
780 + }
781 + ],
782 + "datasource": {
783 + "type": "grafana-opensearch-datasource",
784 + "uid": "replace_datasource_uid"
785 + },
786 + "metrics": [
787 + {
788 + "id": "1",
789 + "type": "count"
790 + }
791 + ],
792 + "query": "fw:$firewall AND _exists_:Category",
793 + "refId": "A",
794 + "timeField": "timestamp"
795 + }
796 + ],
797 + "title": "DST IP AND COUNTRY",
798 + "transformations": [
799 + {
800 + "id": "organize",
801 + "options": {
802 + "excludeByName": {},
803 + "indexByName": {},
804 + "renameByName": {
805 + "devname": "FIREWALL",
806 + "fw": "FIREWALL"
807 + }
808 + }
809 + }
810 + ],
811 + "transparent": true,
812 + "type": "table"
813 + },
814 + {
815 + "datasource": {
816 + "type": "grafana-opensearch-datasource",
817 + "uid": "replace_datasource_uid"
818 + },
819 + "fieldConfig": {
820 + "defaults": {
821 + "color": {
822 + "mode": "palette-classic"
823 + },
824 + "custom": {
825 + "hideFrom": {
826 + "legend": false,
827 + "tooltip": false,
828 + "viz": false
829 + }
830 + },
831 + "mappings": []
832 + },
833 + "overrides": [
834 + {
835 + "matcher": {
836 + "id": "byName",
837 + "options": "INFO"
838 + },
839 + "properties": [
840 + {
841 + "id": "color",
842 + "value": {
843 + "fixedColor": "blue",
844 + "mode": "fixed"
845 + }
846 + }
847 + ]
848 + },
849 + {
850 + "matcher": {
851 + "id": "byName",
852 + "options": "Alert"
853 + },
854 + "properties": [
855 + {
856 + "id": "color",
857 + "value": {
858 + "fixedColor": "light-red",
859 + "mode": "fixed"
860 + }
861 + }
862 + ]
863 + },
864 + {
865 + "matcher": {
866 + "id": "byName",
867 + "options": "Notice"
868 + },
869 + "properties": [
870 + {
871 + "id": "color",
872 + "value": {
873 + "fixedColor": "light-blue",
874 + "mode": "fixed"
875 + }
876 + }
877 + ]
878 + },
879 + {
880 + "matcher": {
881 + "id": "byName",
882 + "options": "Warning"
883 + },
884 + "properties": [
885 + {
886 + "id": "color",
887 + "value": {
888 + "fixedColor": "orange",
889 + "mode": "fixed"
890 + }
891 + }
892 + ]
893 + },
894 + {
895 + "matcher": {
896 + "id": "byName",
897 + "options": "Error"
898 + },
899 + "properties": [
900 + {
901 + "id": "color",
902 + "value": {
903 + "fixedColor": "super-light-red",
904 + "mode": "fixed"
905 + }
906 + }
907 + ]
908 + }
909 + ]
910 + },
911 + "gridPos": {
912 + "h": 8,
913 + "w": 6,
914 + "x": 0,
915 + "y": 16
916 + },
917 + "id": 8,
918 + "options": {
919 + "legend": {
920 + "displayMode": "table",
921 + "placement": "right",
922 + "showLegend": true
923 + },
924 + "pieType": "donut",
925 + "reduceOptions": {
926 + "calcs": [
927 + "sum"
928 + ],
929 + "fields": "",
930 + "values": false
931 + },
932 + "tooltip": {
933 + "mode": "single",
934 + "sort": "none"
935 + }
936 + },
937 + "targets": [
938 + {
939 + "alias": "",
940 + "bucketAggs": [
941 + {
942 + "field": "syslog_level",
943 + "id": "3",
944 + "settings": {
945 + "min_doc_count": "1",
946 + "order": "desc",
947 + "orderBy": "_count",
948 + "size": "15"
949 + },
950 + "type": "terms"
951 + },
952 + {
953 + "field": "timestamp",
954 + "id": "2",
955 + "settings": {
956 + "interval": "auto"
957 + },
958 + "type": "date_histogram"
959 + }
960 + ],
961 + "datasource": {
962 + "type": "grafana-opensearch-datasource",
963 + "uid": "replace_datasource_uid"
964 + },
965 + "metrics": [
966 + {
967 + "id": "1",
968 + "type": "count"
969 + }
970 + ],
971 + "query": "fw:$firewall AND _exists_:Category",
972 + "refId": "A",
973 + "timeField": "timestamp"
974 + }
975 + ],
976 + "title": "LOGS BY SEVERITY",
977 + "type": "piechart"
978 + },
979 + {
980 + "datasource": {
981 + "type": "grafana-opensearch-datasource",
982 + "uid": "replace_datasource_uid"
983 + },
984 + "fieldConfig": {
985 + "defaults": {
986 + "color": {
987 + "mode": "palette-classic"
988 + },
989 + "custom": {
990 + "axisBorderShow": false,
991 + "axisCenteredZero": false,
992 + "axisColorMode": "text",
993 + "axisLabel": "",
994 + "axisPlacement": "auto",
995 + "barAlignment": 0,
996 + "drawStyle": "bars",
997 + "fillOpacity": 0,
998 + "gradientMode": "none",
999 + "hideFrom": {
1000 + "legend": false,
1001 + "tooltip": false,
1002 + "viz": false
1003 + },
1004 + "insertNulls": false,
1005 + "lineInterpolation": "linear",
1006 + "lineWidth": 1,
1007 + "pointSize": 5,
1008 + "scaleDistribution": {
1009 + "type": "linear"
1010 + },
1011 + "showPoints": "auto",
1012 + "spanNulls": false,
1013 + "stacking": {
1014 + "group": "A",
1015 + "mode": "none"
1016 + },
1017 + "thresholdsStyle": {
1018 + "mode": "off"
1019 + }
1020 + },
1021 + "mappings": [],
1022 + "thresholds": {
1023 + "mode": "absolute",
1024 + "steps": [
1025 + {
1026 + "color": "green",
1027 + "value": null
1028 + },
1029 + {
1030 + "color": "red",
1031 + "value": 80
1032 + }
1033 + ]
1034 + },
1035 + "unit": "short"
1036 + },
1037 + "overrides": []
1038 + },
1039 + "gridPos": {
1040 + "h": 16,
1041 + "w": 18,
1042 + "x": 6,
1043 + "y": 16
1044 + },
1045 + "id": 7,
1046 + "options": {
1047 + "legend": {
1048 + "calcs": [],
1049 + "displayMode": "table",
1050 + "placement": "right",
1051 + "showLegend": true
1052 + },
1053 + "tooltip": {
1054 + "mode": "single",
1055 + "sort": "none"
1056 + }
1057 + },
1058 + "pluginVersion": "8.5.1",
1059 + "targets": [
1060 + {
1061 + "alias": "",
1062 + "bucketAggs": [
1063 + {
1064 + "field": "fw",
1065 + "id": "3",
1066 + "settings": {
1067 + "min_doc_count": "1",
1068 + "order": "desc",
1069 + "orderBy": "_count",
1070 + "size": "20"
1071 + },
1072 + "type": "terms"
1073 + },
1074 + {
1075 + "field": "timestamp",
1076 + "id": "4",
1077 + "settings": {
1078 + "interval": "5m",
1079 + "min_doc_count": "1",
1080 + "timeZone": "utc",
1081 + "trimEdges": "0"
1082 + },
1083 + "type": "date_histogram"
1084 + }
1085 + ],
1086 + "datasource": {
1087 + "type": "grafana-opensearch-datasource",
1088 + "uid": "replace_datasource_uid"
1089 + },
1090 + "metrics": [
1091 + {
1092 + "id": "1",
1093 + "type": "count"
1094 + }
1095 + ],
1096 + "query": "fw:$firewall AND _exists_:Category",
1097 + "refId": "A",
1098 + "timeField": "timestamp"
1099 + }
1100 + ],
1101 + "title": "LOGS BY FIREWALL - HISTOGRAM (TOP 20)",
1102 + "type": "timeseries"
1103 + },
1104 + {
1105 + "datasource": {
1106 + "type": "grafana-opensearch-datasource",
1107 + "uid": "replace_datasource_uid"
1108 + },
1109 + "fieldConfig": {
1110 + "defaults": {
1111 + "color": {
1112 + "mode": "palette-classic"
1113 + },
1114 + "custom": {
1115 + "hideFrom": {
1116 + "legend": false,
1117 + "tooltip": false,
1118 + "viz": false
1119 + }
1120 + },
1121 + "mappings": []
1122 + },
1123 + "overrides": [
1124 + {
1125 + "matcher": {
1126 + "id": "byName",
1127 + "options": "information"
1128 + },
1129 + "properties": [
1130 + {
1131 + "id": "color",
1132 + "value": {
1133 + "fixedColor": "blue",
1134 + "mode": "fixed"
1135 + }
1136 + }
1137 + ]
1138 + },
1139 + {
1140 + "matcher": {
1141 + "id": "byName",
1142 + "options": "notice"
1143 + },
1144 + "properties": [
1145 + {
1146 + "id": "color",
1147 + "value": {
1148 + "fixedColor": "green",
1149 + "mode": "fixed"
1150 + }
1151 + }
1152 + ]
1153 + },
1154 + {
1155 + "matcher": {
1156 + "id": "byName",
1157 + "options": "warning"
1158 + },
1159 + "properties": [
1160 + {
1161 + "id": "color",
1162 + "value": {
1163 + "fixedColor": "orange",
1164 + "mode": "fixed"
1165 + }
1166 + }
1167 + ]
1168 + },
1169 + {
1170 + "matcher": {
1171 + "id": "byName",
1172 + "options": "alert"
1173 + },
1174 + "properties": [
1175 + {
1176 + "id": "color",
1177 + "value": {
1178 + "fixedColor": "red",
1179 + "mode": "fixed"
1180 + }
1181 + }
1182 + ]
1183 + },
1184 + {
1185 + "matcher": {
1186 + "id": "byName",
1187 + "options": "block-url"
1188 + },
1189 + "properties": [
1190 + {
1191 + "id": "color",
1192 + "value": {
1193 + "fixedColor": "orange",
1194 + "mode": "fixed"
1195 + }
1196 + }
1197 + ]
1198 + },
1199 + {
1200 + "matcher": {
1201 + "id": "byName",
1202 + "options": "passthrough"
1203 + },
1204 + "properties": [
1205 + {
1206 + "id": "color",
1207 + "value": {
1208 + "fixedColor": "green",
1209 + "mode": "fixed"
1210 + }
1211 + }
1212 + ]
1213 + },
1214 + {
1215 + "matcher": {
1216 + "id": "byName",
1217 + "options": "NA"
1218 + },
1219 + "properties": [
1220 + {
1221 + "id": "color",
1222 + "value": {
1223 + "fixedColor": "orange",
1224 + "mode": "fixed"
1225 + }
1226 + }
1227 + ]
1228 + },
1229 + {
1230 + "matcher": {
1231 + "id": "byName",
1232 + "options": "drop"
1233 + },
1234 + "properties": [
1235 + {
1236 + "id": "color",
1237 + "value": {
1238 + "fixedColor": "red",
1239 + "mode": "fixed"
1240 + }
1241 + }
1242 + ]
1243 + },
1244 + {
1245 + "matcher": {
1246 + "id": "byName",
1247 + "options": "forward"
1248 + },
1249 + "properties": [
1250 + {
1251 + "id": "color",
1252 + "value": {
1253 + "fixedColor": "green",
1254 + "mode": "fixed"
1255 + }
1256 + }
1257 + ]
1258 + },
1259 + {
1260 + "matcher": {
1261 + "id": "byName",
1262 + "options": "mgmt"
1263 + },
1264 + "properties": [
1265 + {
1266 + "id": "color",
1267 + "value": {
1268 + "fixedColor": "blue",
1269 + "mode": "fixed"
1270 + }
1271 + }
1272 + ]
1273 + }
1274 + ]
1275 + },
1276 + "gridPos": {
1277 + "h": 8,
1278 + "w": 6,
1279 + "x": 0,
1280 + "y": 24
1281 + },
1282 + "id": 12,
1283 + "options": {
1284 + "legend": {
1285 + "displayMode": "table",
1286 + "placement": "right",
1287 + "showLegend": true
1288 + },
1289 + "pieType": "donut",
1290 + "reduceOptions": {
1291 + "calcs": [
1292 + "sum"
1293 + ],
1294 + "fields": "",
1295 + "values": false
1296 + },
1297 + "tooltip": {
1298 + "mode": "single",
1299 + "sort": "none"
1300 + }
1301 + },
1302 + "targets": [
1303 + {
1304 + "alias": "",
1305 + "bucketAggs": [
1306 + {
1307 + "field": "fw_action",
1308 + "id": "3",
1309 + "settings": {
1310 + "min_doc_count": "1",
1311 + "order": "desc",
1312 + "orderBy": "_count",
1313 + "size": "15"
1314 + },
1315 + "type": "terms"
1316 + },
1317 + {
1318 + "field": "timestamp",
1319 + "id": "2",
1320 + "settings": {
1321 + "interval": "auto"
1322 + },
1323 + "type": "date_histogram"
1324 + }
1325 + ],
1326 + "datasource": {
1327 + "type": "grafana-opensearch-datasource",
1328 + "uid": "replace_datasource_uid"
1329 + },
1330 + "metrics": [
1331 + {
1332 + "id": "1",
1333 + "type": "count"
1334 + }
1335 + ],
1336 + "query": "fw:$firewall AND _exists_:Category",
1337 + "refId": "A",
1338 + "timeField": "timestamp"
1339 + }
1340 + ],
1341 + "title": "TRAFFIC LOGS BY ACTION",
1342 + "type": "piechart"
1343 + },
1344 + {
1345 + "datasource": {
1346 + "type": "grafana-opensearch-datasource",
1347 + "uid": "replace_datasource_uid"
1348 + },
1349 + "fieldConfig": {
1350 + "defaults": {
1351 + "color": {
1352 + "mode": "palette-classic"
1353 + },
1354 + "custom": {
1355 + "hideFrom": {
1356 + "legend": false,
1357 + "tooltip": false,
1358 + "viz": false
1359 + }
1360 + },
1361 + "mappings": []
1362 + },
1363 + "overrides": []
1364 + },
1365 + "gridPos": {
1366 + "h": 8,
1367 + "w": 6,
1368 + "x": 0,
1369 + "y": 32
1370 + },
1371 + "id": 17,
1372 + "options": {
1373 + "legend": {
1374 + "displayMode": "list",
1375 + "placement": "right",
1376 + "showLegend": false
1377 + },
1378 + "pieType": "pie",
1379 + "reduceOptions": {
1380 + "calcs": [
1381 + "sum"
1382 + ],
1383 + "fields": "",
1384 + "values": false
1385 + },
1386 + "tooltip": {
1387 + "mode": "single",
1388 + "sort": "none"
1389 + }
1390 + },
1391 + "targets": [
1392 + {
1393 + "alias": "",
1394 + "bucketAggs": [
1395 + {
1396 + "field": "note",
1397 + "id": "3",
1398 + "settings": {
1399 + "min_doc_count": "1",
1400 + "order": "desc",
1401 + "orderBy": "_count",
1402 + "size": "15"
1403 + },
1404 + "type": "terms"
1405 + },
1406 + {
1407 + "field": "timestamp",
1408 + "id": "2",
1409 + "settings": {
1410 + "interval": "auto"
1411 + },
1412 + "type": "date_histogram"
1413 + }
1414 + ],
1415 + "datasource": {
1416 + "type": "grafana-opensearch-datasource",
1417 + "uid": "replace_datasource_uid"
1418 + },
1419 + "metrics": [
1420 + {
1421 + "id": "1",
1422 + "type": "count"
1423 + }
1424 + ],
1425 + "query": "fw:$firewall AND _exists_:Category",
1426 + "refId": "A",
1427 + "timeField": "timestamp"
1428 + }
1429 + ],
1430 + "title": "LOGS BY RULE DESCRIPTION (Top 15)",
1431 + "type": "piechart"
1432 + },
1433 + {
1434 + "datasource": {
1435 + "type": "grafana-opensearch-datasource",
1436 + "uid": "replace_datasource_uid"
1437 + },
1438 + "fieldConfig": {
1439 + "defaults": {
1440 + "color": {
1441 + "mode": "thresholds"
1442 + },
1443 + "custom": {
1444 + "align": "auto",
1445 + "cellOptions": {
1446 + "type": "auto"
1447 + },
1448 + "inspect": false
1449 + },
1450 + "mappings": [],
1451 + "thresholds": {
1452 + "mode": "absolute",
1453 + "steps": [
1454 + {
1455 + "color": "green"
1456 + },
1457 + {
1458 + "color": "red",
1459 + "value": 80
1460 + }
1461 + ]
1462 + }
1463 + },
1464 + "overrides": [
1465 + {
1466 + "matcher": {
1467 + "id": "byName",
1468 + "options": "source"
1469 + },
1470 + "properties": [
1471 + {
1472 + "id": "custom.width",
1473 + "value": 473
1474 + }
1475 + ]
1476 + },
1477 + {
1478 + "matcher": {
1479 + "id": "byName",
1480 + "options": "USER ACCOUNT"
1481 + },
1482 + "properties": [
1483 + {
1484 + "id": "custom.width",
1485 + "value": 422
1486 + }
1487 + ]
1488 + },
1489 + {
1490 + "matcher": {
1491 + "id": "byName",
1492 + "options": "INDICATOR"
1493 + },
1494 + "properties": [
1495 + {
1496 + "id": "custom.width",
1497 + "value": 439
1498 + }
1499 + ]
1500 + },
1501 + {
1502 + "matcher": {
1503 + "id": "byName",
1504 + "options": "msg_detail"
1505 + },
1506 + "properties": [
1507 + {
1508 + "id": "custom.width",
1509 + "value": 796
1510 + }
1511 + ]
1512 + },
1513 + {
1514 + "matcher": {
1515 + "id": "byName",
1516 + "options": "note"
1517 + },
1518 + "properties": [
1519 + {
1520 + "id": "custom.width",
1521 + "value": 925
1522 + }
1523 + ]
1524 + }
1525 + ]
1526 + },
1527 + "gridPos": {
1528 + "h": 8,
1529 + "w": 18,
1530 + "x": 6,
1531 + "y": 32
1532 + },
1533 + "id": 14,
1534 + "options": {
1535 + "cellHeight": "sm",
1536 + "footer": {
1537 + "countRows": false,
1538 + "fields": "",
1539 + "reducer": [
1540 + "sum"
1541 + ],
1542 + "show": false
1543 + },
1544 + "showHeader": true,
1545 + "sortBy": []
1546 + },
1547 + "pluginVersion": "10.4.1",
1548 + "targets": [
1549 + {
1550 + "alias": "",
1551 + "bucketAggs": [
1552 + {
1553 + "field": "note",
1554 + "id": "3",
1555 + "settings": {
1556 + "min_doc_count": "1",
1557 + "order": "desc",
1558 + "orderBy": "_count",
1559 + "size": "0"
1560 + },
1561 + "type": "terms"
1562 + }
1563 + ],
1564 + "datasource": {
1565 + "type": "grafana-opensearch-datasource",
1566 + "uid": "replace_datasource_uid"
1567 + },
1568 + "metrics": [
1569 + {
1570 + "id": "1",
1571 + "type": "count"
1572 + }
1573 + ],
1574 + "query": "fw:$firewall AND _exists_:Category",
1575 + "refId": "A",
1576 + "timeField": "timestamp"
1577 + }
1578 + ],
1579 + "title": "LOGS BY RULE DESCRIPTION (Top 15)",
1580 + "transformations": [
1581 + {
1582 + "id": "organize",
1583 + "options": {
1584 + "excludeByName": {},
1585 + "indexByName": {},
1586 + "renameByName": {
1587 + "msg": "INDICATOR",
1588 + "msg_cat": "MSG CATEGORY",
1589 + "user": "USER ACCOUNT"
1590 + }
1591 + }
1592 + }
1593 + ],
1594 + "transparent": true,
1595 + "type": "table"
1596 + },
1597 + {
1598 + "datasource": {
1599 + "type": "grafana-opensearch-datasource",
1600 + "uid": "replace_datasource_uid"
1601 + },
1602 + "fieldConfig": {
1603 + "defaults": {
1604 + "color": {
1605 + "mode": "thresholds"
1606 + },
1607 + "custom": {
1608 + "align": "auto",
1609 + "cellOptions": {
1610 + "type": "auto"
1611 + },
1612 + "inspect": false
1613 + },
1614 + "mappings": [],
1615 + "thresholds": {
1616 + "mode": "absolute",
1617 + "steps": [
1618 + {
1619 + "color": "green"
1620 + },
1621 + {
1622 + "color": "red",
1623 + "value": 80
1624 + }
1625 + ]
1626 + }
1627 + },
1628 + "overrides": [
1629 + {
1630 + "matcher": {
1631 + "id": "byName",
1632 + "options": "FIREWALL"
1633 + },
1634 + "properties": [
1635 + {
1636 + "id": "custom.width",
1637 + "value": 149
1638 + }
1639 + ]
1640 + },
1641 + {
1642 + "matcher": {
1643 + "id": "byName",
1644 + "options": "ACTION"
1645 + },
1646 + "properties": [
1647 + {
1648 + "id": "custom.width",
1649 + "value": 105
1650 + }
1651 + ]
1652 + },
1653 + {
1654 + "matcher": {
1655 + "id": "byName",
1656 + "options": "SEVERITY"
1657 + },
1658 + "properties": [
1659 + {
1660 + "id": "custom.width",
1661 + "value": 109
1662 + },
1663 + {
1664 + "id": "custom.cellOptions",
1665 + "value": {
1666 + "type": "color-text"
1667 + }
1668 + },
1669 + {
1670 + "id": "mappings",
1671 + "value": [
1672 + {
1673 + "options": {
1674 + "Alert": {
1675 + "color": "red",
1676 + "index": 3
1677 + },
1678 + "Critical": {
1679 + "color": "dark-red",
1680 + "index": 4
1681 + },
1682 + "Emergency": {
1683 + "color": "purple",
1684 + "index": 6
1685 + },
1686 + "Error": {
1687 + "color": "red",
1688 + "index": 5
1689 + },
1690 + "Info": {
1691 + "color": "green",
1692 + "index": 1
1693 + },
1694 + "Notice": {
1695 + "color": "blue",
1696 + "index": 0
1697 + },
1698 + "Warning": {
1699 + "color": "orange",
1700 + "index": 2
1701 + }
1702 + },
1703 + "type": "value"
1704 + }
1705 + ]
1706 + }
1707 + ]
1708 + },
1709 + {
1710 + "matcher": {
1711 + "id": "byName",
1712 + "options": "SRC IP"
1713 + },
1714 + "properties": [
1715 + {
1716 + "id": "custom.width",
1717 + "value": 137
1718 + }
1719 + ]
1720 + },
1721 + {
1722 + "matcher": {
1723 + "id": "byName",
1724 + "options": "SRC PORT"
1725 + },
1726 + "properties": [
1727 + {
1728 + "id": "custom.width",
1729 + "value": 87
1730 + }
1731 + ]
1732 + },
1733 + {
1734 + "matcher": {
1735 + "id": "byName",
1736 + "options": "IF IN"
1737 + },
1738 + "properties": [
1739 + {
1740 + "id": "custom.width",
1741 + "value": 110
1742 + }
1743 + ]
1744 + },
1745 + {
1746 + "matcher": {
1747 + "id": "byName",
1748 + "options": "APP"
1749 + },
1750 + "properties": [
1751 + {
1752 + "id": "custom.width",
1753 + "value": 131
1754 + }
1755 + ]
1756 + },
1757 + {
1758 + "matcher": {
1759 + "id": "byName",
1760 + "options": "DST IP"
1761 + },
1762 + "properties": [
1763 + {
1764 + "id": "custom.width",
1765 + "value": 134
1766 + }
1767 + ]
1768 + },
1769 + {
1770 + "matcher": {
1771 + "id": "byName",
1772 + "options": "DST PORT"
1773 + },
1774 + "properties": [
1775 + {
1776 + "id": "custom.width",
1777 + "value": 93
1778 + }
1779 + ]
1780 + },
1781 + {
1782 + "matcher": {
1783 + "id": "byName",
1784 + "options": "EVENT ID"
1785 + },
1786 + "properties": [
1787 + {
1788 + "id": "links",
1789 + "value": [
1790 + {
1791 + "targetBlank": true,
1792 + "title": "EVENT DETAILS",
1793 + "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22SONICWALL%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-1h%22,%22to%22:%22now%22%7D%7D"
1794 + }
1795 + ]
1796 + },
1797 + {
1798 + "id": "custom.width",
1799 + "value": 214
1800 + }
1801 + ]
1802 + },
1803 + {
1804 + "matcher": {
1805 + "id": "byName",
1806 + "options": "SERVICE"
1807 + },
1808 + "properties": [
1809 + {
1810 + "id": "custom.width",
1811 + "value": 95
1812 + }
1813 + ]
1814 + },
1815 + {
1816 + "matcher": {
1817 + "id": "byName",
1818 + "options": "DATE/TIME"
1819 + },
1820 + "properties": [
1821 + {
1822 + "id": "custom.width",
1823 + "value": 188
1824 + }
1825 + ]
1826 + },
1827 + {
1828 + "matcher": {
1829 + "id": "byName",
1830 + "options": "PROFILE"
1831 + },
1832 + "properties": [
1833 + {
1834 + "id": "custom.width",
1835 + "value": 234
1836 + }
1837 + ]
1838 + },
1839 + {
1840 + "matcher": {
1841 + "id": "byName",
1842 + "options": "SRC IF"
1843 + },
1844 + "properties": [
1845 + {
1846 + "id": "custom.width",
1847 + "value": 74
1848 + }
1849 + ]
1850 + },
1851 + {
1852 + "matcher": {
1853 + "id": "byName",
1854 + "options": "PROTO"
1855 + },
1856 + "properties": [
1857 + {
1858 + "id": "custom.width",
1859 + "value": 117
1860 + }
1861 + ]
1862 + },
1863 + {
1864 + "matcher": {
1865 + "id": "byName",
1866 + "options": "DST IF"
1867 + },
1868 + "properties": [
1869 + {
1870 + "id": "custom.width",
1871 + "value": 95
1872 + }
1873 + ]
1874 + }
1875 + ]
1876 + },
1877 + "gridPos": {
1878 + "h": 15,
1879 + "w": 24,
1880 + "x": 0,
1881 + "y": 40
1882 + },
1883 + "id": 16,
1884 + "options": {
1885 + "cellHeight": "sm",
1886 + "footer": {
1887 + "countRows": false,
1888 + "fields": "",
1889 + "reducer": [
1890 + "sum"
1891 + ],
1892 + "show": false
1893 + },
1894 + "showHeader": true,
1895 + "sortBy": []
1896 + },
1897 + "pluginVersion": "10.4.1",
1898 + "targets": [
1899 + {
1900 + "alias": "",
1901 + "bucketAggs": [],
1902 + "datasource": {
1903 + "type": "grafana-opensearch-datasource",
1904 + "uid": "replace_datasource_uid"
1905 + },
1906 + "metrics": [
1907 + {
1908 + "id": "1",
1909 + "settings": {
1910 + "size": "500"
1911 + },
1912 + "type": "raw_data"
1913 + }
1914 + ],
1915 + "query": "fw:$firewall AND _exists_:Category",
1916 + "refId": "A",
1917 + "timeField": "timestamp"
1918 + }
1919 + ],
1920 + "title": "FIREWALL EVENTS",
1921 + "transformations": [
1922 + {
1923 + "id": "organize",
1924 + "options": {
1925 + "excludeByName": {
1926 + "_index": true,
1927 + "_type": true,
1928 + "alert_category": true,
1929 + "alert_definitions_version": true,
1930 + "alertlight": true,
1931 + "app": true,
1932 + "appName": true,
1933 + "appcat": true,
1934 + "appid": true,
1935 + "arg": true,
1936 + "c": true,
1937 + "cat": true,
1938 + "catdesc": true,
1939 + "category": true,
1940 + "catid": true,
1941 + "code": true,
1942 + "craction": true,
1943 + "crlevel": true,
1944 + "crscore": true,
1945 + "devid": true,
1946 + "direction": true,
1947 + "dpi": true,
1948 + "dst": true,
1949 + "dstMAC": true,
1950 + "dstMac": true,
1951 + "dst_host": false,
1952 + "dst_ip_city_name": true,
1953 + "dst_ip_country_code": true,
1954 + "dst_ip_geolocation": true,
1955 + "dstintf": true,
1956 + "dstintfrole": true,
1957 + "dstip": true,
1958 + "dstip_city_name": true,
1959 + "dstip_country_code": true,
1960 + "dstip_geolocation": true,
1961 + "dstname_city_name": true,
1962 + "dstname_country_code": true,
1963 + "dstname_geolocation": true,
1964 + "dstport": true,
1965 + "eventtype": true,
1966 + "facility": true,
1967 + "facility_num": true,
1968 + "fw_city_name": true,
1969 + "fw_country_code": true,
1970 + "fw_geolocation": true,
1971 + "gl2_accounted_message_size": true,
1972 + "gl2_message_id": true,
1973 + "gl2_remote_ip": true,
1974 + "gl2_remote_port": true,
1975 + "gl2_source_input": true,
1976 + "gl2_source_node": true,
1977 + "group": true,
1978 + "highlight": true,
1979 + "hostname": true,
1980 + "hostname_city_name": true,
1981 + "hostname_country_code": true,
1982 + "hostname_geolocation": true,
1983 + "id": true,
1984 + "level": true,
1985 + "logdesc": false,
1986 + "logver": true,
1987 + "m": true,
1988 + "message": true,
1989 + "method": true,
1990 + "msg": false,
1991 + "msg_cat": true,
1992 + "msg_detail": false,
1993 + "n": true,
1994 + "note": true,
1995 + "op": true,
1996 + "policyid": true,
1997 + "proto": false,
1998 + "rcvd": true,
1999 + "rcvdbyte": true,
2000 + "reqtype": true,
2001 + "rule": true,
2002 + "sent": true,
2003 + "sentbyte": true,
2004 + "sessionid": true,
2005 + "sid": true,
2006 + "sn": true,
2007 + "sort": true,
2008 + "source": true,
2009 + "source_city_name": true,
2010 + "source_country_code": true,
2011 + "source_geolocation": true,
2012 + "src": true,
2013 + "srcMac": true,
2014 + "src_ip_city_name": true,
2015 + "src_ip_country_code": true,
2016 + "src_ip_geolocation": true,
2017 + "srcintf": true,
2018 + "srcintfrole": true,
2019 + "srcip": true,
2020 + "srcip_city_name": true,
2021 + "srcip_country_code": true,
2022 + "srcip_geolocation": true,
2023 + "srcport": true,
2024 + "streams": true,
2025 + "subtype": false,
2026 + "syslog_type": true,
2027 + "time": true,
2028 + "type": true,
2029 + "user": true,
2030 + "vd": true
2031 + },
2032 + "indexByName": {
2033 + "_id": 1,
2034 + "_index": 7,
2035 + "_type": 8,
2036 + "appid": 18,
2037 + "catid": 19,
2038 + "dst": 20,
2039 + "dstMAC": 21,
2040 + "dst_host": 22,
2041 + "dst_if": 26,
2042 + "dst_ip": 23,
2043 + "dst_ip_city_name": 27,
2044 + "dst_ip_country_code": 28,
2045 + "dst_ip_geolocation": 29,
2046 + "dst_port": 24,
2047 + "facility": 30,
2048 + "facility_num": 31,
2049 + "fw": 2,
2050 + "fw_action": 32,
2051 + "fw_city_name": 33,
2052 + "fw_country_code": 34,
2053 + "fw_geolocation": 35,
2054 + "gl2_accounted_message_size": 9,
2055 + "gl2_message_id": 10,
2056 + "gl2_remote_ip": 11,
2057 + "gl2_remote_port": 12,
2058 + "gl2_source_input": 13,
2059 + "gl2_source_node": 14,
2060 + "highlight": 36,
2061 + "id": 37,
2062 + "level": 38,
2063 + "message": 15,
2064 + "msg": 39,
2065 + "proto": 25,
2066 + "rule": 40,
2067 + "sid": 41,
2068 + "sn": 42,
2069 + "sort": 43,
2070 + "source": 6,
2071 + "source_city_name": 44,
2072 + "source_country_code": 45,
2073 + "source_geolocation": 46,
2074 + "src": 47,
2075 + "srcMac": 48,
2076 + "src_if": 5,
2077 + "src_ip": 3,
2078 + "src_ip_city_name": 49,
2079 + "src_ip_country_code": 50,
2080 + "src_ip_geolocation": 51,
2081 + "src_port": 4,
2082 + "streams": 16,
2083 + "syslog_type": 17,
2084 + "timestamp": 0
2085 + },
2086 + "renameByName": {
2087 + "Category": "CATEGORY",
2088 + "_id": "EVENT ID",
2089 + "action": "ACTION",
2090 + "alert_signature": "SIGNATURE",
2091 + "app": "APP",
2092 + "destination_location_name": "LOCATION",
2093 + "devname": "FIREWALL",
2094 + "dst_host": "DST HOSTNAME",
2095 + "dst_if": "DST IF",
2096 + "dst_ip": "DST IP",
2097 + "dst_port": "DST PORT",
2098 + "dstip": "DST IP",
2099 + "dstname": "DST NAME",
2100 + "dstport": "DST PORT",
2101 + "event_log_name": "",
2102 + "fw": "FIREWALL",
2103 + "fw_action": "ACTION",
2104 + "http_method": "METHOD",
2105 + "http_user_agent_name": "HTTP AGENT",
2106 + "logdesc": "DESCRIPTION",
2107 + "msg": "MESSAGE",
2108 + "msg_detail": "MSG DETAIL",
2109 + "network_interface_in": "IF IN",
2110 + "network_interface_out": "IF OUT",
2111 + "network_transport": "",
2112 + "profile": "PROFILE",
2113 + "proto": "PROTO",
2114 + "rule_name": "RULE",
2115 + "service": "SERVICE",
2116 + "source": "",
2117 + "source_port": "SRC PORT",
2118 + "src_if": "SRC IF",
2119 + "src_ip": "SRC IP",
2120 + "src_port": "SRC PORT",
2121 + "srcip": "SRC IP",
2122 + "subtype": "SUBTYPE",
2123 + "syslog_level": "SEVERITY",
2124 + "timestamp": "DATE/TIME",
2125 + "url": "URL"
2126 + }
2127 + }
2128 + }
2129 + ],
2130 + "transparent": true,
2131 + "type": "table"
2132 + }
2133 + ],
2134 + "schemaVersion": 39,
2135 + "tags": [
2136 + "SONICWALL"
2137 + ],
2138 + "templating": {
2139 + "list": [
2140 + {
2141 + "current": {
2142 + "selected": false,
2143 + "text": "All",
2144 + "value": "$__all"
2145 + },
2146 + "datasource": {
2147 + "type": "grafana-opensearch-datasource",
2148 + "uid": "replace_datasource_uid"
2149 + },
2150 + "definition": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"_exists_:Category\"}",
2151 + "description": "FORTINET FIREWALL",
2152 + "hide": 0,
2153 + "includeAll": true,
2154 + "label": "Firewall",
2155 + "multi": false,
2156 + "name": "firewall",
2157 + "options": [],
2158 + "query": "{ \"find\": \"terms\", \"field\": \"fw\", \"query\": \"_exists_:Category\"}",
2159 + "refresh": 1,
2160 + "regex": "",
2161 + "skipUrlSync": false,
2162 + "sort": 0,
2163 + "type": "query"
2164 + },
2165 + {
2166 + "datasource": {
2167 + "type": "grafana-opensearch-datasource",
2168 + "uid": "replace_datasource_uid"
2169 + },
2170 + "filters": [],
2171 + "hide": 0,
2172 + "name": "Filters",
2173 + "skipUrlSync": false,
2174 + "type": "adhoc"
2175 + }
2176 + ]
2177 + },
2178 + "time": {
2179 + "from": "now-6h",
2180 + "to": "now"
2181 + },
2182 + "timepicker": {},
2183 + "timezone": "",
2184 + "title": "SONICWALL - WEB CONTROL",
2185 + "weekStart": ""
2186 +}
backend/app/connectors/grafana/schema/dashboards.py
+9
@@ -118,6 +118,14 @@ class DefenderForEndpointDashboard(Enum):
118 DEFENDERFORENDPOINT_SUMMARY = ("DefenderForEndpoint", "summary.json")
119
120
121 +class SonicwallDashboard(Enum):
122 + SONICWALL_SUMMARY = ("Sonicwall", "sonicwall_summary.json")
123 + SONICWALL_VPN = ("Sonicwall", "sonicwall_vpn.json")
124 + SONICWALL_APP_CONTROL = ("Sonicwall", "sonicwall_app_control.json")
125 + SONICWALL_SD_WAN = ("Sonicwall", "sonicwall_sdwan.json")
126 + SONICWALL_IPS = ("Sonicwall", "sonicwall_ips.json")
127 +
128 +
129 class DashboardProvisionRequest(BaseModel):
130 dashboards: List[str] = Field(
131 ...,
@@ -154,6 +162,7 @@ class DashboardProvisionRequest(BaseModel):
162 + list(BitdefenderDashboard)
163 + list(CatoDashboard)
164 + list(DefenderForEndpointDashboard)
165 + + list(SonicwallDashboard)
166 }
167 if e not in valid_dashboards:
168 raise ValueError(f'Dashboard identifier "{e}" is not recognized.')
backend/app/connectors/grafana/services/dashboards.py
+2
@@ -19,6 +19,7 @@ from app.connectors.grafana.schema.dashboards import HuntressDashboard
19 from app.connectors.grafana.schema.dashboards import MimecastDashboard
20 from app.connectors.grafana.schema.dashboards import Office365Dashboard
21 from app.connectors.grafana.schema.dashboards import SapSiemDashboard
22 +from app.connectors.grafana.schema.dashboards import SonicwallDashboard
23 from app.connectors.grafana.schema.dashboards import WazuhDashboard
24 from app.connectors.grafana.utils.universal import create_grafana_client
25
@@ -191,6 +192,7 @@ async def provision_dashboards(
192 + list(BitdefenderDashboard)
193 + list(CatoDashboard)
194 + list(DefenderForEndpointDashboard)
195 + + list(SonicwallDashboard)
196 }
197
198 for dashboard_name in dashboard_request.dashboards:
backend/app/db/db_populate.py
+4
@@ -612,6 +612,7 @@ def get_available_network_connectors_list():
612 """
613 available_network_connectors = [
614 ("Fortinet", "Integrate Fortinet with SOCFortress."),
615 + ("Sonicwall", "Integrate Sonicwall with SOCFortress."),
616 # ... Add more available network_connectors as needed ...
617 ]
618
@@ -702,6 +703,9 @@ async def get_available_network_connectors_auth_keys_list(session: AsyncSession)
703 available_network_connectors_auth_keys = []
704 available_network_connectors = [
705 ("Fortinet", "SYSLOG_PORT"),
706 + ("Sonicwall", "SYSLOG_PORT"),
707 + ("Sonicwall", "TLS_CERT_FILE"),
708 + ("Sonicwall", "TLS_KEY_FILE"),
709 # ... Add more available network_connectors auth keys as needed ...
710 ]
711 logger.info("Getting available network_connectors auth keys.")
backend/app/integrations/routes.py
+1
@@ -63,6 +63,7 @@ NETWORK_INTEGRATIONS = [
63 "CROWDSTRIKE",
64 "FORTINET",
65 "Fortinet",
66 + "Sonicwall",
67 # Add other network integrations as needed
68 ]
69
backend/app/network_connectors/markdown/sonicwall.md new
+137
@@ -0,0 +1,137 @@
1 +# SonicWall Syslog Forwarding
2 +
3 +This process involves configuring the SonicWall firewall to send logs to an external syslog server.
4 +
5 +## Method 1: Direct Syslog Forwarding (UDP/TCP)
6 +
7 +For direct syslog forwarding from SonicWall to your SIEM stack, follow the [SonicWall Syslog Configuration Guide](https://socfortress.supportbench.net/ar-1084/).
8 +
9 +### Step 1: Accessing the SonicWall Firewall
10 +
11 +Log in to your SonicWall firewall using the web management interface:
12 +
13 +- Open a web browser.
14 +- Navigate to the IP address of the SonicWall unit (e.g., `https://192.168.1.1`).
15 +- Enter your administrative credentials to log in.
16 +
17 +### Step 2: Configuring Syslog Settings
18 +
19 +Once logged in, follow these steps to configure syslog forwarding:
20 +
21 +- **Navigate to Log Settings**
22 + - Go to **Log** > **Settings** in the left-hand navigation menu.
23 + - Click on the **Syslog** tab.
24 +
25 +- **Enable Syslog**
26 + - Check the box to **Enable Syslog**.
27 +
28 +- **Configure Syslog Server Details**
29 + - **Name or IP Address:** Enter the IP address or hostname of your syslog server.
30 + - **Port:** Specify the port number (default is 514 for UDP, or custom port for TCP).
31 + - **Syslog Format:** Select the syslog format (recommended: **Syslog** or **CEF**).
32 + - **Syslog ID:** (Optional) Enter a unique identifier for this SonicWall device.
33 +
34 +- **Select Log Categories**
35 + - Choose which categories of logs to forward:
36 + - System Maintenance
37 + - System Errors
38 + - Blocked Web Sites
39 + - Blocked Java etc.
40 + - User Activity
41 + - Attacks
42 + - Dropped TCP/UDP/ICMP
43 + - Network Debug
44 + - And any other relevant categories
45 +
46 +- **Configure Advanced Settings (Optional)**
47 + - **Syslog Facility:** Select the facility code (e.g., Local0 through Local7).
48 + - **Display Format:** Choose how the logs should be formatted.
49 +
50 +### Step 3: Saving the Configuration
51 +
52 +After entering all the necessary configurations:
53 +
54 +- Click **Accept** or **Apply** to save the settings.
55 +- The SonicWall firewall will now start forwarding logs to the specified syslog server.
56 +
57 +### Step 4: Verify Log Reception
58 +
59 +Check your syslog server to verify that it is receiving logs from the SonicWall firewall. Monitor the logs to ensure proper formatting and categorization.
60 +
61 +---
62 +
63 +## Method 2: TLS Encrypted Forwarding via Syslog-NG (Recommended for Production)
64 +
65 +For secure, encrypted log forwarding, use a local syslog-ng collector to receive UDP logs from SonicWall within your local network, then forward them via TLS to your SIEM stack.
66 +
67 +### Overview
68 +
69 +This method provides:
70 +- **Security:** TLS encryption for logs in transit over the internet
71 +- **Reliability:** Local collection prevents log loss due to network issues
72 +- **Flexibility:** Ability to preprocess or enrich logs before forwarding
73 +
74 +### Architecture
75 +
76 +```
77 +SonicWall (UDP) → Syslog-NG Collector (Local Network) → TLS → SIEM Stack
78 +```
79 +
80 +### Step 1: Deploy Local Log Collector
81 +
82 +Follow the [Local Log Collector using Syslog-NG Guide](https://socfortress.supportbench.net/article/local-log-collector-using-syslog-ng) to set up your local collector.
83 +
84 +The local collector will:
85 +1. Listen for UDP syslog messages from your SonicWall firewall
86 +2. Receive logs on the local network (e.g., port 514/UDP)
87 +3. Encrypt and forward logs via TLS to your SIEM stack
88 +
89 +### Step 2: Configure SonicWall for Local Collector
90 +
91 +Configure your SonicWall to send logs to the **local syslog-ng collector IP address**:
92 +
93 +- **Navigate to Log Settings**
94 + - Go to **Log** > **Settings** > **Syslog** tab
95 +
96 +- **Configure Local Collector as Syslog Server**
97 + - **Name or IP Address:** Enter the IP address of your local syslog-ng collector
98 + - **Port:** 514 (UDP) or the port configured on your collector
99 + - **Syslog Format:** Syslog or CEF
100 + - Enable relevant log categories
101 +
102 +- **Apply Configuration**
103 + - Click **Accept** to save the settings
104 +
105 +### Step 3: Configure Syslog-NG for TLS Forwarding
106 +
107 +On your local syslog-ng collector, configure the destination to forward logs via TLS to your SIEM stack:
108 +
109 +- Reference the [Syslog-NG TLS Configuration Guide](https://socfortress.supportbench.net/article/local-log-collector-using-syslog-ng) for detailed steps
110 +- Ensure TLS certificates are properly configured
111 +- Configure the destination with your SIEM stack's IP address and TLS port
112 +
113 +### Step 4: Verify End-to-End Log Flow
114 +
115 +1. **Check Local Collection:** Verify syslog-ng is receiving logs from SonicWall
116 +2. **Check TLS Connection:** Verify syslog-ng establishes TLS connection to SIEM
117 +3. **Check SIEM Reception:** Verify logs appear in your SIEM stack with proper source identification
118 +
119 +### Additional Considerations
120 +
121 +- **Certificate Management:** Keep TLS certificates up to date and properly secured
122 +- **Collector High Availability:** Consider deploying redundant collectors for production environments
123 +- **Network Segmentation:** Ensure the local collector is in the same network segment as the SonicWall for optimal performance
124 +- **Firewall Rules:** Ensure:
125 + - SonicWall can reach the local collector on the configured UDP port
126 + - Local collector can reach the SIEM stack on the configured TLS port
127 + - No firewall rules block outbound TLS traffic from the collector
128 +
129 +---
130 +
131 +## General Additional Considerations
132 +
133 +- **Security:** For internet-facing log forwarding, always use TLS encryption (Method 2)
134 +- **Backup Configurations:** Always keep a backup of your firewall configurations before making changes
135 +- **Log Volume:** Monitor the volume of logs being generated to ensure your syslog infrastructure can handle the load
136 +- **Time Synchronization:** Ensure all devices (SonicWall, collector, SIEM) have synchronized time using NTP
137 +- **Testing:** Test the configuration in a non-production environment first if possible
backend/app/routers/stack_provisioning.py
+10
@@ -9,6 +9,9 @@ from app.stack_provisioning.graylog.routes.fortinet import (
9 from app.stack_provisioning.graylog.routes.provision import (
10 stack_provisioning_graylog_router,
11 )
12 +from app.stack_provisioning.graylog.routes.sonicwall import (
13 + stack_provisioning_graylog_sonicwall_router,
14 +)
15
16 # Instantiate the APIRouter
17 router = APIRouter()
@@ -33,3 +36,10 @@ router.include_router(
36 prefix="/stack_decommissioning",
37 tags=["Stack Decommissioning"],
38 )
39 +
40 +# Include the Stack Provisioning related routes
41 +router.include_router(
42 + stack_provisioning_graylog_sonicwall_router,
43 + prefix="/stack_provisioning",
44 + tags=["Stack Provisioning"],
45 +)
backend/app/stack_provisioning/graylog/routes/sonicwall.py new
+121
@@ -0,0 +1,121 @@
1 +from typing import Dict
2 +
3 +from fastapi import APIRouter
4 +from fastapi import Depends
5 +from fastapi import HTTPException
6 +from fastapi import Security
7 +from sqlalchemy.ext.asyncio import AsyncSession
8 +
9 +from app.auth.utils import AuthHandler
10 +from app.db.db_session import get_db
11 +from app.network_connectors.routes import find_customer_network_connector
12 +from app.network_connectors.routes import (
13 + get_customer_network_connectors_by_customer_code,
14 +)
15 +from app.network_connectors.schema import CustomerNetworkConnectors
16 +from app.network_connectors.schema import CustomerNetworkConnectorsResponse
17 +from app.stack_provisioning.graylog.schema.sonicwall import ProvisionSonicwallKeys
18 +from app.stack_provisioning.graylog.schema.sonicwall import ProvisionSonicwallRequest
19 +from app.stack_provisioning.graylog.schema.sonicwall import ProvisionSonicwallResponse
20 +from app.stack_provisioning.graylog.schema.sonicwall import SonicwallCustomerDetails
21 +from app.stack_provisioning.graylog.services.sonicwall import provision_sonicwall
22 +
23 +stack_provisioning_graylog_sonicwall_router = APIRouter()
24 +
25 +
26 +async def get_customer_integration_response(
27 + customer_code: str,
28 + session: AsyncSession,
29 +) -> CustomerNetworkConnectorsResponse:
30 + """
31 + Retrieves the integration response for a customer.
32 +
33 + Args:
34 + customer_code (str): The code of the customer.
35 + session (AsyncSession): The async session object for database operations.
36 +
37 + Returns:
38 + CustomerNetworkConnectorsResponse: The integration response for the customer.
39 +
40 + Raises:
41 + HTTPException: If the customer integration settings are not found.
42 + """
43 + customer_integration_response = await get_customer_network_connectors_by_customer_code(
44 + customer_code,
45 + session,
46 + )
47 + if customer_integration_response.available_network_connectors == []:
48 + raise HTTPException(
49 + status_code=404,
50 + detail="Customer integration settings not found.",
51 + )
52 + return customer_integration_response
53 +
54 +
55 +def extract_sonicwall_keys(
56 + customer_integration: CustomerNetworkConnectors,
57 +) -> Dict[str, str]:
58 + """
59 + Extracts the authentication keys for SonicWall integration from the given customer integration.
60 +
61 + Args:
62 + customer_integration (CustomerNetworkConnectors): The customer integration object.
63 +
64 + Returns:
65 + Dict[str, str]: A dictionary containing the authentication keys for SonicWall integration.
66 +
67 + Raises:
68 + HTTPException: If no authentication keys are found for SonicWall integration.
69 + """
70 + sonicwall_keys = {}
71 + for subscription in customer_integration.network_connectors_subscriptions:
72 + if subscription.network_connectors_service.service_name == "Sonicwall":
73 + for auth_key in subscription.network_connectors_keys:
74 + sonicwall_keys[auth_key.auth_key_name] = auth_key.auth_value
75 + if not sonicwall_keys:
76 + raise HTTPException(
77 + status_code=404,
78 + detail="No auth keys found for Sonicwall integration. Please create auth keys for Sonicwall network connector.",
79 + )
80 + return sonicwall_keys
81 +
82 +
83 +@stack_provisioning_graylog_sonicwall_router.post(
84 + "/graylog/provision/sonicwall",
85 + response_model=ProvisionSonicwallResponse,
86 + description="Provision SonicWall for the customer.",
87 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
88 +)
89 +async def provision_sonicwall_route(
90 + provision_sonicwall_request: ProvisionSonicwallRequest,
91 + session: AsyncSession = Depends(get_db),
92 +) -> ProvisionSonicwallResponse:
93 + """
94 + Provision SonicWall for the customer
95 + """
96 + customer_integration_response = await get_customer_integration_response(
97 + provision_sonicwall_request.customer_code,
98 + session,
99 + )
100 +
101 + customer_integration = await find_customer_network_connector(
102 + provision_sonicwall_request.customer_code,
103 + provision_sonicwall_request.integration_name,
104 + customer_integration_response,
105 + )
106 +
107 + sonicwall_keys = extract_sonicwall_keys(customer_integration)
108 +
109 + return await provision_sonicwall(
110 + customer_details=SonicwallCustomerDetails(
111 + customer_code=provision_sonicwall_request.customer_code,
112 + customer_name=customer_integration.customer_name,
113 + tls_cert_file=sonicwall_keys["TLS_CERT_FILE"],
114 + tls_key_file=sonicwall_keys["TLS_KEY_FILE"],
115 + syslog_port=int(sonicwall_keys["SYSLOG_PORT"]),
116 + hot_data_retention=provision_sonicwall_request.hot_data_retention,
117 + index_replicas=provision_sonicwall_request.index_replicas,
118 + ),
119 + keys=ProvisionSonicwallKeys(**sonicwall_keys),
120 + session=session,
121 + )
backend/app/stack_provisioning/graylog/schema/decommission.py
+4
@@ -16,6 +16,10 @@ class AvailableNetworkConnectors(str, Enum):
16 "The Crowdstrike Network Connector which includes Input, Stream, Pipeline Rules,"
17 " Pipelines, and Lookup Tables for Crowdstrike logs and the SOCFortress SIEM stack."
18 )
19 + SONICWALL = (
20 + "The Sonicwall Network Connector which includes Input, Stream, Pipeline Rules,"
21 + " Pipelines, and Lookup Tables for Sonicwall logs and the SOCFortress SIEM stack."
22 + )
23
24
25 class DecommissionNetworkContentPackRequest(BaseModel):
backend/app/stack_provisioning/graylog/schema/provision.py
+23
@@ -31,6 +31,9 @@ class AvailableContentPacks(str, Enum):
31 SOCFORTRESS_BITDEFENDER_STREAM = "The Bitdefender Stream content pack"
32 SOCFORTRESS_DEFENDER_FOR_ENDPOINT_INPUT_TCP = "The Defender for Endpoint Input TCP content pack"
33 SOCFORTRESS_DEFENDER_FOR_ENDPOINT_STREAM = "The Defender for Endpoint Stream content pack"
34 + SOCFORTRESS_SONICWALL_INPUT_SYSLOG_TLS = "The Sonicwall Input Syslog TLS content pack"
35 + SOCFORTRESS_SONICWALL_STREAM = "The Sonicwall Stream content pack"
36 + SOCFORTRESS_SONICWALL_PROCESSING_PIPELINE = "The Sonicwall Processing Pipeline content pack"
37
38
39 class ContentPackKeywords(BaseModel):
@@ -46,6 +49,16 @@ class ContentPackKeywords(BaseModel):
49 example=514,
50 description="The syslog port of the content pack",
51 )
52 + tls_cert_file: Optional[str] = Field(
53 + None,
54 + example="/etc/graylog/sonicwall/cert.pem",
55 + description="The TLS certificate file path of the content pack",
56 + )
57 + tls_key_file: Optional[str] = Field(
58 + None,
59 + example="/etc/graylog/sonicwall/key.pem",
60 + description="The TLS key file path of the content pack",
61 + )
62
63
64 class ContentPack(BaseModel):
@@ -148,3 +161,13 @@ class ReplaceContentPackKeywords(BaseModel):
161 example=514,
162 description="The syslog port",
163 )
164 + TLS_CERT_FILE: Optional[str] = Field(
165 + None,
166 + example="/etc/graylog/sonicwall/cert.pem",
167 + description="The TLS certificate file path",
168 + )
169 + TLS_KEY_FILE: Optional[str] = Field(
170 + None,
171 + example="/etc/graylog/sonicwall/key.pem",
172 + description="The TLS key file path",
173 + )
backend/app/stack_provisioning/graylog/schema/sonicwall.py new
+102
@@ -0,0 +1,102 @@
1 +from typing import Any
2 +from typing import Dict
3 +from typing import Optional
4 +
5 +from pydantic import BaseModel
6 +from pydantic import Field
7 +from pydantic import root_validator
8 +
9 +
10 +class ProvisionSonicwallRequest(BaseModel):
11 + customer_code: str = Field(
12 + ...,
13 + description="The customer code.",
14 + examples=["00002"],
15 + )
16 + integration_name: str = Field(
17 + "Sonicwall",
18 + description="The integration name.",
19 + examples=["Sonicwall"],
20 + )
21 + tls_enabled: Optional[bool] = Field(
22 + False,
23 + description="TLS enabled for secure log forwarding.",
24 + examples=[True],
25 + )
26 + hot_data_retention: int = Field(
27 + ...,
28 + example=30,
29 + description="Number of days to retain hot data",
30 + )
31 + index_replicas: int = Field(
32 + ...,
33 + example=1,
34 + description="Number of replicas for the customer's Graylog instance",
35 + )
36 +
37 + # ensure the `integration_name` is always set to "Sonicwall"
38 + @root_validator(pre=True)
39 + def set_integration_name(cls, values: Dict[str, Any]) -> Dict[str, Any]:
40 + values["integration_name"] = "Sonicwall"
41 + return values
42 +
43 +
44 +class ProvisionSonicwallResponse(BaseModel):
45 + success: bool
46 + message: str
47 +
48 +
49 +class ProvisionSonicwallKeys(BaseModel):
50 + SYSLOG_PORT: str = Field(
51 + ...,
52 + description="The syslog port.",
53 + examples=["514"],
54 + )
55 + TLS_CERT_FILE: str = Field(
56 + ...,
57 + description="The TLS certificate file path.",
58 + examples=["/etc/graylog/server/certs/Sonicwall_cert.pem"],
59 + )
60 + TLS_KEY_FILE: str = Field(
61 + ...,
62 + description="The TLS key file path.",
63 + examples=["/etc/graylog/server/certs/Sonicwall_key.key"],
64 + )
65 +
66 +
67 +class SonicwallCustomerDetails(BaseModel):
68 + customer_name: str = Field(
69 + ...,
70 + description="The customer name.",
71 + examples=["Customer 1"],
72 + )
73 + customer_code: str = Field(
74 + ...,
75 + description="The customer code.",
76 + examples=["00002"],
77 + )
78 + syslog_port: int = Field(
79 + ...,
80 + description="The syslog port.",
81 + examples=[514],
82 + )
83 + tls_cert_file: str = Field(
84 + ...,
85 + description="The TLS certificate file path.",
86 + examples=["/etc/graylog/server/certs/Sonicwall_cert.pem"],
87 + )
88 + tls_key_file: str = Field(
89 + ...,
90 + description="The TLS key file path.",
91 + examples=["/etc/graylog/server/certs/Sonicwall_key.key"],
92 + )
93 + hot_data_retention: int = Field(
94 + ...,
95 + example=30,
96 + description="Number of days to retain hot data",
97 + )
98 + index_replicas: int = Field(
99 + ...,
100 + example=1,
101 + description="Number of replicas for the customer's Graylog instance",
102 + )
backend/app/stack_provisioning/graylog/services/provision.py
+2
@@ -260,6 +260,8 @@ async def process_content_pack(content_pack, content_pack_request):
260 customer_name=content_pack_request.keywords.customer_name,
261 customer_code=content_pack_request.keywords.customer_code,
262 SYSLOG_PORT=content_pack_request.keywords.syslog_port,
263 + TLS_CERT_FILE=content_pack_request.keywords.tls_cert_file,
264 + TLS_KEY_FILE=content_pack_request.keywords.tls_key_file,
265 )
266 if "PROCESSING_PIPELINE" not in content_pack:
267 content_pack = replace_keywords_in_json_complex(content_pack, replace_content_pack_keywords.dict())
backend/app/stack_provisioning/graylog/services/sonicwall.py new
+409
@@ -0,0 +1,409 @@
1 +import json
2 +from datetime import datetime
3 +
4 +from fastapi import HTTPException
5 +from loguru import logger
6 +from sqlalchemy.ext.asyncio import AsyncSession
7 +
8 +from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
9 +from app.connectors.grafana.schema.dashboards import SonicwallDashboard
10 +from app.connectors.grafana.services.dashboards import provision_dashboards
11 +from app.connectors.grafana.utils.universal import create_grafana_client
12 +from app.connectors.graylog.services.collector import (
13 + get_content_pack_id_by_content_pack_name,
14 +)
15 +from app.connectors.graylog.services.collector import get_input_id_by_input_name
16 +from app.connectors.graylog.services.collector import get_stream_id_by_stream_name
17 +from app.connectors.graylog.services.streams import assign_stream_to_index
18 +from app.connectors.graylog.utils.universal import send_post_request
19 +from app.connectors.wazuh_indexer.services.monitoring import (
20 + output_shard_number_to_be_set_based_on_nodes,
21 +)
22 +from app.customer_provisioning.schema.grafana import GrafanaDatasource
23 +from app.customer_provisioning.schema.grafana import GrafanaDataSourceCreationResponse
24 +from app.customer_provisioning.schema.graylog import GraylogIndexSetCreationResponse
25 +from app.customer_provisioning.schema.graylog import StreamConnectionToPipelineRequest
26 +from app.customer_provisioning.schema.graylog import TimeBasedIndexSet
27 +from app.customer_provisioning.services.grafana import create_grafana_folder
28 +from app.customer_provisioning.services.grafana import get_opensearch_version
29 +from app.customer_provisioning.services.graylog import connect_stream_to_pipeline
30 +from app.customer_provisioning.services.graylog import get_pipeline_id
31 +from app.customers.routes.customers import get_customer_meta
32 +from app.network_connectors.models.network_connectors import (
33 + CustomerNetworkConnectorsMeta,
34 +)
35 +from app.stack_provisioning.graylog.schema.provision import ContentPackKeywords
36 +from app.stack_provisioning.graylog.schema.provision import (
37 + ProvisionNetworkContentPackRequest,
38 +)
39 +from app.stack_provisioning.graylog.schema.sonicwall import ProvisionSonicwallKeys
40 +from app.stack_provisioning.graylog.schema.sonicwall import ProvisionSonicwallResponse
41 +from app.stack_provisioning.graylog.schema.sonicwall import SonicwallCustomerDetails
42 +from app.stack_provisioning.graylog.services.provision import (
43 + provision_content_pack_network_connector,
44 +)
45 +from app.stack_provisioning.graylog.services.utils import set_deployed_flag
46 +from app.utils import get_connector_attribute
47 +from app.utils import get_customer_meta_attribute
48 +
49 +
50 +#### ! GRAYLOG ! ####
51 +async def build_index_set_config(request: SonicwallCustomerDetails) -> TimeBasedIndexSet:
52 + """
53 + Build the configuration for a time-based index set.
54 +
55 + Args:
56 + request (SonicwallCustomerDetails): The request object containing customer information.
57 +
58 + Returns:
59 + TimeBasedIndexSet: The configured time-based index set.
60 + """
61 + return TimeBasedIndexSet(
62 + title=f"{request.customer_name} - SONICWALL EVENTS",
63 + description=f"{request.customer_name} - SONICWALL EVENTS",
64 + index_prefix=f"sonicwall-{request.customer_code}",
65 + rotation_strategy_class="org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy",
66 + rotation_strategy={
67 + "type": "org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategyConfig",
68 + "rotation_period": "P1D",
69 + "rotate_empty_index_set": False,
70 + "max_rotation_period": None,
71 + },
72 + retention_strategy_class="org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy",
73 + retention_strategy={
74 + "type": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig",
75 + "max_number_of_indices": request.hot_data_retention,
76 + },
77 + creation_date=datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
78 + index_analyzer="standard",
79 + shards=await output_shard_number_to_be_set_based_on_nodes(),
80 + replicas=request.index_replicas,
81 + index_optimization_max_num_segments=1,
82 + index_optimization_disabled=False,
83 + writable=True,
84 + field_type_refresh_interval=5000,
85 + )
86 +
87 +
88 +# Function to send the POST request and handle the response
89 +async def send_index_set_creation_request(
90 + index_set: TimeBasedIndexSet,
91 +) -> GraylogIndexSetCreationResponse:
92 + """
93 + Sends a request to create an index set in Graylog.
94 +
95 + Args:
96 + index_set (TimeBasedIndexSet): The index set to be created.
97 +
98 + Returns:
99 + GraylogIndexSetCreationResponse: The response from Graylog after creating the index set.
100 + """
101 + json_index_set = json.dumps(index_set.dict())
102 + logger.info(f"json_index_set set: {json_index_set}")
103 + response_json = await send_post_request(
104 + endpoint="/api/system/indices/index_sets",
105 + data=index_set.dict(),
106 + )
107 + return GraylogIndexSetCreationResponse(**response_json)
108 +
109 +
110 +# Refactored create_index_set function
111 +async def create_index_set(
112 + request: SonicwallCustomerDetails,
113 +) -> GraylogIndexSetCreationResponse:
114 + """
115 + Creates an index set for a new customer.
116 +
117 + Args:
118 + request (SonicwallCustomerDetails): The request object containing the customer information.
119 +
120 + Returns:
121 + GraylogIndexSetCreationResponse: The response object containing the result of the index set creation.
122 + """
123 + logger.info(f"Creating index set for customer {request.customer_name}")
124 + index_set_config = await build_index_set_config(request)
125 + return await send_index_set_creation_request(index_set_config)
126 +
127 +
128 +async def provision_content_pack(customer_details: SonicwallCustomerDetails):
129 + """
130 + Provisions a content pack for a customer.
131 +
132 + Args:
133 + customer_details (SonicwallCustomerDetails): The details of the customer.
134 +
135 + Returns:
136 + ContentPack: The provisioned content pack.
137 + """
138 + return await provision_content_pack_network_connector(
139 + content_pack_request=ProvisionNetworkContentPackRequest(
140 + content_pack_name="SONICWALL",
141 + keywords=ContentPackKeywords(
142 + customer_name=customer_details.customer_name,
143 + customer_code=customer_details.customer_code,
144 + syslog_port=customer_details.syslog_port,
145 + tls_cert_file=customer_details.tls_cert_file,
146 + tls_key_file=customer_details.tls_key_file,
147 + ),
148 + ),
149 + )
150 +
151 +
152 +async def get_stream_and_index_ids(customer_details: SonicwallCustomerDetails):
153 + """
154 + Retrieves the stream ID and index ID for a given customer.
155 +
156 + Args:
157 + customer_details (SonicwallCustomerDetails): The details of the customer.
158 +
159 + Returns:
160 + tuple: A tuple containing the stream ID and index ID.
161 + """
162 + stream_id = await get_stream_id_by_stream_name(stream_name=f"{customer_details.customer_name} - SONICWALL LOGS AND EVENTS")
163 + index_id = (await create_index_set(request=customer_details)).data.id
164 + content_pack_stream_id = await get_content_pack_id_by_content_pack_name(
165 + content_pack_name=f"{customer_details.customer_name}_SONICWALL_STREAM",
166 + )
167 +
168 + content_pack_input_id = await get_content_pack_id_by_content_pack_name(
169 + content_pack_name=f"{customer_details.customer_name}_SONICWALL_INPUT_SYSLOG_TLS",
170 + )
171 +
172 + return stream_id, index_id, content_pack_stream_id, content_pack_input_id
173 +
174 +
175 +#### ! GRAFANA ! ####
176 +async def create_grafana_datasource(
177 + customer_code: str,
178 + session: AsyncSession,
179 +) -> GrafanaDataSourceCreationResponse:
180 + """
181 + Creates a Grafana datasource for the specified customer.
182 +
183 + Args:
184 + customer_code (str): The customer code.
185 + session (AsyncSession): The async session.
186 +
187 + Returns:
188 + GrafanaDataSourceCreationResponse: The response containing the created datasource details.
189 + """
190 + logger.info("Creating Grafana datasource")
191 + grafana_client = await create_grafana_client("Grafana")
192 + # Switch to the newly created organization
193 + grafana_client.user.switch_actual_user_organisation(
194 + (await get_customer_meta(customer_code, session)).customer_meta.customer_meta_grafana_org_id,
195 + )
196 + datasource_payload = GrafanaDatasource(
197 + name="SONICWALL",
198 + type="grafana-opensearch-datasource",
199 + typeName="OpenSearch",
200 + access="proxy",
201 + url=await get_connector_attribute(
202 + connector_id=1,
203 + column_name="connector_url",
204 + session=session,
205 + ),
206 + database=f"sonicwall-{customer_code}*",
207 + basicAuth=True,
208 + basicAuthUser=await get_connector_attribute(
209 + connector_id=1,
210 + column_name="connector_username",
211 + session=session,
212 + ),
213 + secureJsonData={
214 + "basicAuthPassword": await get_connector_attribute(
215 + connector_id=1,
216 + column_name="connector_password",
217 + session=session,
218 + ),
219 + },
220 + isDefault=False,
221 + jsonData={
222 + "database": f"sonicwall-{customer_code}*",
223 + "flavor": "opensearch",
224 + "includeFrozen": False,
225 + "logLevelField": "severity",
226 + "logMessageField": "summary",
227 + "maxConcurrentShardRequests": 5,
228 + "pplEnabled": True,
229 + "timeField": "timestamp",
230 + "tlsSkipVerify": True,
231 + "version": await get_opensearch_version(),
232 + },
233 + readOnly=True,
234 + )
235 + results = grafana_client.datasource.create_datasource(
236 + datasource=datasource_payload.dict(),
237 + )
238 + return GrafanaDataSourceCreationResponse(**results)
239 +
240 +
241 +async def create_customer_network_connector_meta(
242 + customer_details,
243 + stream_id,
244 + index_id,
245 + content_pack_stream_id,
246 + content_pack_input_id,
247 + session,
248 +):
249 + """
250 + Create a CustomerNetworkConnectorsMeta object with the provided details.
251 +
252 + Args:
253 + customer_details (CustomerDetails): Details of the customer.
254 + stream_id (int): ID of the Graylog stream.
255 + index_id (int): ID of the Graylog index.
256 + content_pack_stream_id (int): ID of the content pack stream.
257 + content_pack_input_id (int): ID of the content pack input.
258 + session (Session): Database session.
259 +
260 + Returns:
261 + CustomerNetworkConnectorsMeta: The created CustomerNetworkConnectorsMeta object.
262 + """
263 + return CustomerNetworkConnectorsMeta(
264 + customer_code=customer_details.customer_code,
265 + network_connector_name="SONICWALL",
266 + graylog_stream_id=stream_id,
267 + graylog_input_id=(
268 + await get_input_id_by_input_name(input_name=f"{customer_details.customer_name} - SONICWALL FIREWALL LOGS AND EVENTS - TLS")
269 + ),
270 + graylog_pipeline_id=((await get_pipeline_id(subscription="SONICWALL"))[0]),
271 + graylog_content_pack_input_id=content_pack_input_id,
272 + graylog_content_pack_stream_id=content_pack_stream_id,
273 + grafana_org_id=(
274 + await get_customer_meta_attribute(
275 + session=session,
276 + customer_code=customer_details.customer_code,
277 + column_name="customer_meta_grafana_org_id",
278 + )
279 + ),
280 + graylog_index_id=index_id,
281 + grafana_dashboard_folder_id=None,
282 + grafana_datasource_uid=None,
283 + )
284 +
285 +
286 +async def validate_grafana_organization_id(customer_code, session):
287 + """
288 + Validate the Grafana organization ID for the customer.
289 +
290 + Args:
291 + customer_code (str): The customer code.
292 + session (Session): Database session.
293 +
294 + Returns:
295 + int: The Grafana organization ID.
296 + """
297 + return await get_customer_meta_attribute(session=session, customer_code=customer_code, column_name="customer_meta_grafana_org_id")
298 +
299 +
300 +async def provision_sonicwall(
301 + customer_details: SonicwallCustomerDetails,
302 + keys: ProvisionSonicwallKeys,
303 + session: AsyncSession,
304 +) -> ProvisionSonicwallResponse:
305 + """
306 + Provisions a SonicWall customer by performing the following steps:
307 + 1. Validates Grafana organization ID exists.
308 + 2. Provisions the content pack for the customer.
309 + 3. Retrieves the stream and index IDs for the customer.
310 + 4. Creates customer network connector metadata.
311 + 5. Assigns the stream to the index.
312 + 6. Retrieves the pipeline ID for the "SONICWALL" subscription.
313 + 7. Connects the stream to the pipeline.
314 + 8. Creates Grafana datasource and dashboards.
315 + 9. Inserts the customer network connector metadata into the database.
316 + 10. Sets the deployed flag.
317 +
318 + Args:
319 + customer_details (SonicwallCustomerDetails): The details of the Sonicwall customer.
320 + keys (ProvisionSonicwallKeys): The keys required for provisioning.
321 + session (AsyncSession): The database session.
322 +
323 + Returns:
324 + ProvisionSonicwallResponse: Response indicating success or failure.
325 + """
326 + if await validate_grafana_organization_id(customer_details.customer_code, session) is None:
327 + raise HTTPException(status_code=404, detail="Grafana organization ID not found. Please provision Grafana for the customer first.")
328 +
329 + await provision_content_pack(customer_details)
330 + stream_id, index_id, content_pack_stream_id, content_pack_input_id = await get_stream_and_index_ids(customer_details)
331 + customer_network_connector_meta = await create_customer_network_connector_meta(
332 + customer_details,
333 + stream_id,
334 + index_id,
335 + content_pack_stream_id,
336 + content_pack_input_id,
337 + session,
338 + )
339 + await assign_stream_to_index(stream_id=stream_id, index_id=index_id)
340 + pipeline_id = await get_pipeline_id(subscription="SONICWALL")
341 + await connect_stream_to_pipeline(stream_and_pipeline=StreamConnectionToPipelineRequest(stream_id=stream_id, pipeline_ids=pipeline_id))
342 +
343 + # Grafana Deployment
344 + customer_network_connector_meta.grafana_datasource_uid = (
345 + await create_grafana_datasource(
346 + customer_code=customer_details.customer_code,
347 + session=session,
348 + )
349 + ).datasource.uid
350 + grafana_folder = await create_grafana_folder(
351 + organization_id=(
352 + await get_customer_meta(
353 + customer_details.customer_code,
354 + session,
355 + )
356 + ).customer_meta.customer_meta_grafana_org_id,
357 + folder_title="SONICWALL",
358 + )
359 + await provision_dashboards(
360 + DashboardProvisionRequest(
361 + dashboards=[dashboard.name for dashboard in SonicwallDashboard],
362 + organizationId=(
363 + await get_customer_meta(
364 + customer_details.customer_code,
365 + session,
366 + )
367 + ).customer_meta.customer_meta_grafana_org_id,
368 + folderId=grafana_folder.id,
369 + datasourceUid=customer_network_connector_meta.grafana_datasource_uid,
370 + ),
371 + )
372 + customer_network_connector_meta.grafana_dashboard_folder_id = grafana_folder.uid
373 + await insert_into_customer_network_connectors_meta_table(
374 + customer_network_connectors_meta=customer_network_connector_meta,
375 + session=session,
376 + )
377 +
378 + await set_deployed_flag(
379 + customer_code=customer_details.customer_code,
380 + network_connector_service_name="Sonicwall",
381 + flag=True,
382 + session=session,
383 + )
384 +
385 + return ProvisionSonicwallResponse(
386 + message="Sonicwall customer provisioned successfully",
387 + success=True,
388 + )
389 +
390 +
391 +async def insert_into_customer_network_connectors_meta_table(
392 + customer_network_connectors_meta: CustomerNetworkConnectorsMeta,
393 + session: AsyncSession,
394 +) -> None:
395 + """
396 + Insert the customer network connectors meta into the database.
397 +
398 + Args:
399 + customer_network_connectors_meta (CustomerNetworkConnectorsMeta): The customer network connectors meta to insert.
400 + session (AsyncSession): The async session object for database operations.
401 +
402 + Returns:
403 + None
404 + """
405 + logger.info("Inserting customer network connectors meta into the database")
406 + session.add(customer_network_connectors_meta)
407 + await session.commit()
408 + logger.info("Customer network connectors meta inserted successfully")
409 + return None
backend/app/stack_provisioning/graylog/templates/SOCFORTRESS_SONICWALL_INPUT_SYSLOG_TLS.json new
+130
@@ -0,0 +1,130 @@
1 +{
2 + "v": 1,
3 + "id": "REPLACE_UUID_GLOBAL",
4 + "rev": 1,
5 + "name": "customer_name_SONICWALL_INPUT_SYSLOG_TLS",
6 + "summary": "customer_name_SONICWALL_INPUT_SYSLOG_TLS",
7 + "description": "",
8 + "vendor": "SOCFortress",
9 + "url": "",
10 + "parameters": [],
11 + "entities": [
12 + {
13 + "v": "1",
14 + "type": {
15 + "name": "input",
16 + "version": "1"
17 + },
18 + "id": "REPLACE_UUID_SPECIFIC",
19 + "data": {
20 + "title": {
21 + "@type": "string",
22 + "@value": "customer_name - SONICWALL FIREWALL LOGS AND EVENTS - TLS"
23 + },
24 + "configuration": {
25 + "tls_key_file": {
26 + "@type": "string",
27 + "@value": "/etc/graylog/server/certs/TLS_KEY_FILE"
28 + },
29 + "port": {
30 + "@type": "integer",
31 + "@value": "SYSLOG_PORT"
32 + },
33 + "tls_enable": {
34 + "@type": "boolean",
35 + "@value": true
36 + },
37 + "use_null_delimiter": {
38 + "@type": "boolean",
39 + "@value": false
40 + },
41 + "recv_buffer_size": {
42 + "@type": "integer",
43 + "@value": 1048576
44 + },
45 + "tcp_keepalive": {
46 + "@type": "boolean",
47 + "@value": false
48 + },
49 + "force_rdns": {
50 + "@type": "boolean",
51 + "@value": false
52 + },
53 + "allow_override_date": {
54 + "@type": "boolean",
55 + "@value": true
56 + },
57 + "tls_client_auth_cert_file": {
58 + "@type": "string",
59 + "@value": "/etc/graylog/server/certs/clients"
60 + },
61 + "bind_address": {
62 + "@type": "string",
63 + "@value": "0.0.0.0"
64 + },
65 + "tls_cert_file": {
66 + "@type": "string",
67 + "@value": "/etc/graylog/server/certs/TLS_CERT_FILE"
68 + },
69 + "expand_structured_data": {
70 + "@type": "boolean",
71 + "@value": false
72 + },
73 + "max_message_size": {
74 + "@type": "integer",
75 + "@value": 2097152
76 + },
77 + "store_full_message": {
78 + "@type": "boolean",
79 + "@value": false
80 + },
81 + "tls_client_auth": {
82 + "@type": "string",
83 + "@value": "optional"
84 + },
85 + "timezone": {
86 + "@type": "string",
87 + "@value": "NotSet"
88 + },
89 + "charset_name": {
90 + "@type": "string",
91 + "@value": "UTF-8"
92 + },
93 + "number_worker_threads": {
94 + "@type": "integer",
95 + "@value": 8
96 + },
97 + "tls_key_password": {
98 + "@type": "string",
99 + "@value": ""
100 + }
101 + },
102 + "static_fields": {
103 + "syslog_type": {
104 + "@type": "string",
105 + "@value": "sonicwall"
106 + },
107 + "syslog_customer": {
108 + "@type": "string",
109 + "@value": "customer_code"
110 + }
111 + },
112 + "type": {
113 + "@type": "string",
114 + "@value": "org.graylog2.inputs.syslog.tcp.SyslogTCPInput"
115 + },
116 + "global": {
117 + "@type": "boolean",
118 + "@value": true
119 + },
120 + "extractors": []
121 + },
122 + "constraints": [
123 + {
124 + "type": "server-version",
125 + "version": ">=5.0.13+083613e"
126 + }
127 + ]
128 + }
129 + ]
130 +}
backend/app/stack_provisioning/graylog/templates/SOCFORTRESS_SONICWALL_PROCESSING_PIPELINE.json new
+489
@@ -0,0 +1,489 @@
1 +{
2 + "v": 1,
3 + "id": "36cc5ea6-7755-4e4d-896f-5749df3a4cb3",
4 + "rev": 1,
5 + "name": "SOCFORTRESS_SONICWALL_PROCESSING_PIPELINE",
6 + "summary": "SOCFORTRESS_SONICWALL_PROCESSING_PIPELINE",
7 + "description": "",
8 + "vendor": "SOCFortress",
9 + "url": "",
10 + "parameters": [],
11 + "entities": [
12 + {
13 + "v": "1",
14 + "type": {
15 + "name": "pipeline_rule",
16 + "version": "1"
17 + },
18 + "id": "69453bf6-cb99-4b47-9475-45a6ca364542",
19 + "data": {
20 + "title": {
21 + "@type": "string",
22 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Warning"
23 + },
24 + "description": {
25 + "@type": "string",
26 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Warning"
27 + },
28 + "source": {
29 + "@type": "string",
30 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Warning\"\nwhen to_long($message.level) == 4\nthen\nset_field(\"syslog_level\", \"Warning\");\nend"
31 + }
32 + },
33 + "constraints": [
34 + {
35 + "type": "server-version",
36 + "version": ">=5.0.13+083613e"
37 + }
38 + ]
39 + },
40 + {
41 + "v": "1",
42 + "type": {
43 + "name": "pipeline_rule",
44 + "version": "1"
45 + },
46 + "id": "81b553f2-7e54-4305-ba49-b1e44ac2960a",
47 + "data": {
48 + "title": {
49 + "@type": "string",
50 + "@value": "DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA"
51 + },
52 + "description": {
53 + "@type": "string",
54 + "@value": "DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA"
55 + },
56 + "source": {
57 + "@type": "string",
58 + "@value": "rule \"DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA\"\nwhen\n to_long($message.level) == 1 AND $message.fw_action == \"NA\" AND $message.msg_cat != \"IPS Detection Alert\"\nthen\n drop_message();\nend"
59 + }
60 + },
61 + "constraints": [
62 + {
63 + "type": "server-version",
64 + "version": ">=5.0.13+083613e"
65 + }
66 + ]
67 + },
68 + {
69 + "v": "1",
70 + "type": {
71 + "name": "pipeline_rule",
72 + "version": "1"
73 + },
74 + "id": "b15ef1f4-a91b-441f-bbec-6cf80860d434",
75 + "data": {
76 + "title": {
77 + "@type": "string",
78 + "@value": "SONICWALL SRC IP - THREAT INTEL"
79 + },
80 + "description": {
81 + "@type": "string",
82 + "@value": "SONICWALL SRC IP - THREAT INTEL"
83 + },
84 + "source": {
85 + "@type": "string",
86 + "@value": "rule \"SONICWALL SRC IP - THREAT INTEL\"\nwhen\n ! has_field(\"src_ip_reserved_ip\")\nthen\nlet ip_and_ampersand = concat(to_string($message.src_ip), \"&customer_code=\");\nlet new_key = concat(ip_and_ampersand, to_string($message.syslog_customer));\n let ldata = lookup(\n lookup_table: \"threatintellookup\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
87 + }
88 + },
89 + "constraints": [
90 + {
91 + "type": "server-version",
92 + "version": ">=5.0.13+083613e"
93 + }
94 + ]
95 + },
96 + {
97 + "v": "1",
98 + "type": {
99 + "name": "pipeline_rule",
100 + "version": "1"
101 + },
102 + "id": "253ee75a-97a8-44c4-b0aa-7b27e3bafee9",
103 + "data": {
104 + "title": {
105 + "@type": "string",
106 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency"
107 + },
108 + "description": {
109 + "@type": "string",
110 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency"
111 + },
112 + "source": {
113 + "@type": "string",
114 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency\"\nwhen to_long($message.level) == 0\nthen\nset_field(\"syslog_level\", \"Emergency\");\nend"
115 + }
116 + },
117 + "constraints": [
118 + {
119 + "type": "server-version",
120 + "version": ">=5.0.13+083613e"
121 + }
122 + ]
123 + },
124 + {
125 + "v": "1",
126 + "type": {
127 + "name": "pipeline_rule",
128 + "version": "1"
129 + },
130 + "id": "fcbd228d-3b3d-4746-82d9-f8b54a54377a",
131 + "data": {
132 + "title": {
133 + "@type": "string",
134 + "@value": "SonicWall dst - Extract IP, Port and Interface"
135 + },
136 + "description": {
137 + "@type": "string",
138 + "@value": "SonicWall dst - Extract IP, Port and Interface"
139 + },
140 + "source": {
141 + "@type": "string",
142 + "@value": "rule \"SonicWall dst - Extract IP, Port and Interface\"\nwhen\nhas_field(\"dst\")\nthen\n let result1 = regex(\"^([0-9,\\\\.]+)\",to_string($message.dst));\n set_field(\"dst_ip\", result1[\"0\"]);\n let result2 = regex(\"^[0-9,\\\\.]+\\\\:([0-9]+)\",to_string($message.dst));\n set_field(\"dst_port\", result2[\"0\"]); \n let result3 = regex(\"^[0-9,\\\\.]+\\\\:[0-9]+\\\\:([A-Z,0-9]+)\",to_string($message.dst));\n set_field(\"dst_interface\", result3[\"0\"]);\n let result4 = regex(\"^[0-9,\\\\.]+\\\\:([A-Z,0-9]+)$\",to_string($message.dst));\n set_field(\"dst_interface\", result4[\"0\"]); \nend"
143 + }
144 + },
145 + "constraints": [
146 + {
147 + "type": "server-version",
148 + "version": ">=5.0.13+083613e"
149 + }
150 + ]
151 + },
152 + {
153 + "v": "1",
154 + "type": {
155 + "name": "pipeline_rule",
156 + "version": "1"
157 + },
158 + "id": "4717aa45-7ede-45db-8130-5702924969f6",
159 + "data": {
160 + "title": {
161 + "@type": "string",
162 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Debug"
163 + },
164 + "description": {
165 + "@type": "string",
166 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Debug"
167 + },
168 + "source": {
169 + "@type": "string",
170 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Debug\"\nwhen to_long($message.level) == 7\nthen\nset_field(\"syslog_level\", \"Debug\");\nend"
171 + }
172 + },
173 + "constraints": [
174 + {
175 + "type": "server-version",
176 + "version": ">=5.0.13+083613e"
177 + }
178 + ]
179 + },
180 + {
181 + "v": "1",
182 + "type": {
183 + "name": "pipeline_rule",
184 + "version": "1"
185 + },
186 + "id": "8e894827-c82d-4480-9750-920fb10bd0c4",
187 + "data": {
188 + "title": {
189 + "@type": "string",
190 + "@value": "DROP SONICWALL LOGS - LEVEL 6, CONNS"
191 + },
192 + "description": {
193 + "@type": "string",
194 + "@value": "DROP SONICWALL LOGS - LEVEL 6, CONNS"
195 + },
196 + "source": {
197 + "@type": "string",
198 + "@value": "rule \"DROP SONICWALL LOGS - LEVEL 6, CONNS\"\nwhen\n to_long($message.level) == 6 AND ($message.msg == \"Connection Closed\" OR $message.msg == \"Connection Opened\")\nthen\n drop_message();\nend"
199 + }
200 + },
201 + "constraints": [
202 + {
203 + "type": "server-version",
204 + "version": ">=5.0.13+083613e"
205 + }
206 + ]
207 + },
208 + {
209 + "v": "1",
210 + "type": {
211 + "name": "pipeline_rule",
212 + "version": "1"
213 + },
214 + "id": "58c692b4-7f2f-465d-ba44-59d8a1f13312",
215 + "data": {
216 + "title": {
217 + "@type": "string",
218 + "@value": "SONICWALL DST IP - THREAT INTEL"
219 + },
220 + "description": {
221 + "@type": "string",
222 + "@value": "SONICWALL DST IP - THREAT INTEL"
223 + },
224 + "source": {
225 + "@type": "string",
226 + "@value": "rule \"SONICWALL DST IP - THREAT INTEL\"\nwhen\n ! has_field(\"dst_ip_reserved_ip\")\nthen\nlet ip_and_ampersand = concat(to_string($message.dst_ip), \"&customer_code=\");\nlet new_key = concat(ip_and_ampersand, to_string($message.syslog_customer));\n let ldata = lookup(\n lookup_table: \"threatintellookup\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
227 + }
228 + },
229 + "constraints": [
230 + {
231 + "type": "server-version",
232 + "version": ">=5.0.13+083613e"
233 + }
234 + ]
235 + },
236 + {
237 + "v": "1",
238 + "type": {
239 + "name": "pipeline_rule",
240 + "version": "1"
241 + },
242 + "id": "9773b642-8a13-43e7-b4f7-84e29fb61dd6",
243 + "data": {
244 + "title": {
245 + "@type": "string",
246 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Critical"
247 + },
248 + "description": {
249 + "@type": "string",
250 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Critical"
251 + },
252 + "source": {
253 + "@type": "string",
254 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Critical\"\nwhen to_long($message.level) == 2\nthen\nset_field(\"syslog_level\", \"Critical\");\nend"
255 + }
256 + },
257 + "constraints": [
258 + {
259 + "type": "server-version",
260 + "version": ">=5.0.13+083613e"
261 + }
262 + ]
263 + },
264 + {
265 + "v": "1",
266 + "type": {
267 + "name": "pipeline_rule",
268 + "version": "1"
269 + },
270 + "id": "6bec12f2-dbc8-446c-b0a0-066938cda27a",
271 + "data": {
272 + "title": {
273 + "@type": "string",
274 + "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND"
275 + },
276 + "description": {
277 + "@type": "string",
278 + "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND"
279 + },
280 + "source": {
281 + "@type": "string",
282 + "@value": "rule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nwhen\n has_field(\"threat_intel_value\")\nthen\n set_field(\"syslog_level\", \"ALERT\");\nend"
283 + }
284 + },
285 + "constraints": [
286 + {
287 + "type": "server-version",
288 + "version": ">=5.0.13+083613e"
289 + }
290 + ]
291 + },
292 + {
293 + "v": "1",
294 + "type": {
295 + "name": "pipeline_rule",
296 + "version": "1"
297 + },
298 + "id": "3d3f27de-7806-4184-b909-63885f7b1391",
299 + "data": {
300 + "title": {
301 + "@type": "string",
302 + "@value": "SONICWALL - key_value_parser"
303 + },
304 + "description": {
305 + "@type": "string",
306 + "@value": "SONICWALL - key_value_parser"
307 + },
308 + "source": {
309 + "@type": "string",
310 + "@value": "rule \"SONICWALL - key_value_parser\"\nwhen\n has_field(\"message\")\nthen\n set_fields(\n fields:\n key_value(\n value: to_string($message.message),\n trim_value_chars: \"\\\"\",\n delimiters: \" \",\n kv_delimiters: \"=\"\n )\n );\nend"
311 + }
312 + },
313 + "constraints": [
314 + {
315 + "type": "server-version",
316 + "version": ">=5.0.13+083613e"
317 + }
318 + ]
319 + },
320 + {
321 + "v": "1",
322 + "type": {
323 + "name": "pipeline_rule",
324 + "version": "1"
325 + },
326 + "id": "5d9310c5-3dea-48a3-ab91-0a14618074b3",
327 + "data": {
328 + "title": {
329 + "@type": "string",
330 + "@value": "SonicWall src - Extract IP, Port and Interface"
331 + },
332 + "description": {
333 + "@type": "string",
334 + "@value": "SonicWall src - Extract IP, Port and Interface"
335 + },
336 + "source": {
337 + "@type": "string",
338 + "@value": "rule \"SonicWall src - Extract IP, Port and Interface\"\nwhen\nhas_field(\"src\")\nthen\n let result1 = regex(\"^([0-9,\\\\.]+)\",to_string($message.src));\n set_field(\"src_ip\", result1[\"0\"]);\n let result2 = regex(\"^[0-9,\\\\.]+\\\\:([0-9]+)\",to_string($message.src));\n set_field(\"src_port\", result2[\"0\"]); \n let result3 = regex(\"^[0-9,\\\\.]+\\\\:[0-9]+\\\\:([A-Z,0-9]+)\",to_string($message.src));\n set_field(\"src_interface\", result3[\"0\"]);\n let result4 = regex(\"^[0-9,\\\\.]+\\\\:([A-Z,0-9]+)$\",to_string($message.src));\n set_field(\"src_interface\", result4[\"0\"]); \nend"
339 + }
340 + },
341 + "constraints": [
342 + {
343 + "type": "server-version",
344 + "version": ">=5.0.13+083613e"
345 + }
346 + ]
347 + },
348 + {
349 + "v": "1",
350 + "type": {
351 + "name": "pipeline_rule",
352 + "version": "1"
353 + },
354 + "id": "353eaac6-15e4-4bb5-8e3d-71e04b5115e5",
355 + "data": {
356 + "title": {
357 + "@type": "string",
358 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Notice"
359 + },
360 + "description": {
361 + "@type": "string",
362 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Notice"
363 + },
364 + "source": {
365 + "@type": "string",
366 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Notice\"\nwhen to_long($message.level) == 5\nthen\nset_field(\"syslog_level\", \"Notice\");\nend"
367 + }
368 + },
369 + "constraints": [
370 + {
371 + "type": "server-version",
372 + "version": ">=5.0.13+083613e"
373 + }
374 + ]
375 + },
376 + {
377 + "v": "1",
378 + "type": {
379 + "name": "pipeline_rule",
380 + "version": "1"
381 + },
382 + "id": "d0335e13-f48c-4601-bd1e-2a945585ca96",
383 + "data": {
384 + "title": {
385 + "@type": "string",
386 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Alert"
387 + },
388 + "description": {
389 + "@type": "string",
390 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Alert"
391 + },
392 + "source": {
393 + "@type": "string",
394 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Alert\"\nwhen to_long($message.level) == 1\nthen\nset_field(\"syslog_level\", \"Alert\");\nend"
395 + }
396 + },
397 + "constraints": [
398 + {
399 + "type": "server-version",
400 + "version": ">=5.0.13+083613e"
401 + }
402 + ]
403 + },
404 + {
405 + "v": "1",
406 + "type": {
407 + "name": "pipeline_rule",
408 + "version": "1"
409 + },
410 + "id": "5ee057f5-290e-4549-86e4-8f384b3a5112",
411 + "data": {
412 + "title": {
413 + "@type": "string",
414 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Error"
415 + },
416 + "description": {
417 + "@type": "string",
418 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - Error"
419 + },
420 + "source": {
421 + "@type": "string",
422 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Error\"\nwhen to_long($message.level) == 3\nthen\nset_field(\"syslog_level\", \"Error\");\nend"
423 + }
424 + },
425 + "constraints": [
426 + {
427 + "type": "server-version",
428 + "version": ">=5.0.13+083613e"
429 + }
430 + ]
431 + },
432 + {
433 + "v": "1",
434 + "type": {
435 + "name": "pipeline_rule",
436 + "version": "1"
437 + },
438 + "id": "93adfd3a-6cd2-4335-875a-38970729a6c8",
439 + "data": {
440 + "title": {
441 + "@type": "string",
442 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - INFO"
443 + },
444 + "description": {
445 + "@type": "string",
446 + "@value": "SONICWALL CREATE FIELD SYSLOG LEVEL - INFO"
447 + },
448 + "source": {
449 + "@type": "string",
450 + "@value": "rule \"SONICWALL CREATE FIELD SYSLOG LEVEL - INFO\"\nwhen to_long($message.level) == 6\nthen\nset_field(\"syslog_level\", \"INFO\");\nend"
451 + }
452 + },
453 + "constraints": [
454 + {
455 + "type": "server-version",
456 + "version": ">=5.0.13+083613e"
457 + }
458 + ]
459 + },
460 + {
461 + "v": "1",
462 + "type": {
463 + "name": "pipeline",
464 + "version": "1"
465 + },
466 + "id": "37a1065a-77e2-4a3f-b63d-0053200ec995",
467 + "data": {
468 + "title": {
469 + "@type": "string",
470 + "@value": "SONICWALL PROCESSING PIPELINE"
471 + },
472 + "description": {
473 + "@type": "string",
474 + "@value": "SONICWALL PROCESSING PIPELINE"
475 + },
476 + "source": {
477 + "@type": "string",
478 + "@value": "pipeline \"SONICWALL PROCESSING PIPELINE\"\nstage 0 match either\nrule \"SONICWALL - key_value_parser\"\nstage 1 match pass\nrule \"DROP SONICWALL LOGS - LEVEL 6, CONNS\"\nrule \"DROP SONICWALL LOGS - LEVEL 1, FW ACTION NA\"\nstage 2 match pass\nrule \"SonicWall dst - Extract IP, Port and Interface\"\nrule \"SonicWall src - Extract IP, Port and Interface\"\nstage 3 match pass\nrule \"SONICWALL DST IP - THREAT INTEL\"\nrule \"SONICWALL SRC IP - THREAT INTEL\"\nstage 4 match either\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Emergency\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Warning\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Debug\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Alert\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Critical\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Notice\"\nrule \"SONICWALL CREATE FIELD SYSLOG LEVEL - Error\"\nstage 5 match either\nrule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nend"
479 + }
480 + },
481 + "constraints": [
482 + {
483 + "type": "server-version",
484 + "version": ">=5.0.13+083613e"
485 + }
486 + ]
487 + }
488 + ]
489 +}
backend/app/stack_provisioning/graylog/templates/SOCFORTRESS_SONICWALL_STREAM.json new
+102
@@ -0,0 +1,102 @@
1 +{
2 + "v": 1,
3 + "id": "REPLACE_UUID_GLOBAL",
4 + "rev": 1,
5 + "name": "customer_name_SONICWALL_STREAM",
6 + "summary": "customer_name_SONICWALL_STREAM",
7 + "description": "",
8 + "vendor": "SOCFortress",
9 + "url": "",
10 + "parameters": [],
11 + "entities": [
12 + {
13 + "v": "1",
14 + "type": {
15 + "name": "stream",
16 + "version": "1"
17 + },
18 + "id": "REPLACE_UUID_SPECIFIC",
19 + "data": {
20 + "alarm_callbacks": [],
21 + "outputs": [],
22 + "remove_matches": {
23 + "@type": "boolean",
24 + "@value": true
25 + },
26 + "title": {
27 + "@type": "string",
28 + "@value": "customer_name - SONICWALL LOGS AND EVENTS"
29 + },
30 + "stream_rules": [
31 + {
32 + "type": {
33 + "@type": "string",
34 + "@value": "EXACT"
35 + },
36 + "field": {
37 + "@type": "string",
38 + "@value": "syslog_type"
39 + },
40 + "value": {
41 + "@type": "string",
42 + "@value": "sonicwall"
43 + },
44 + "inverted": {
45 + "@type": "boolean",
46 + "@value": false
47 + },
48 + "description": {
49 + "@type": "string",
50 + "@value": ""
51 + }
52 + },
53 + {
54 + "type": {
55 + "@type": "string",
56 + "@value": "EXACT"
57 + },
58 + "field": {
59 + "@type": "string",
60 + "@value": "syslog_customer"
61 + },
62 + "value": {
63 + "@type": "string",
64 + "@value": "customer_code"
65 + },
66 + "inverted": {
67 + "@type": "boolean",
68 + "@value": false
69 + },
70 + "description": {
71 + "@type": "string",
72 + "@value": ""
73 + }
74 + }
75 + ],
76 + "alert_conditions": [],
77 + "matching_type": {
78 + "@type": "string",
79 + "@value": "AND"
80 + },
81 + "disabled": {
82 + "@type": "boolean",
83 + "@value": false
84 + },
85 + "description": {
86 + "@type": "string",
87 + "@value": "customer_name - SONICWALL LOGS AND EVENTS"
88 + },
89 + "default_stream": {
90 + "@type": "boolean",
91 + "@value": false
92 + }
93 + },
94 + "constraints": [
95 + {
96 + "type": "server-version",
97 + "version": ">=5.0.13+083613e"
98 + }
99 + ]
100 + }
101 + ]
102 +}
frontend/src/api/endpoints/networkConnectors.ts
+19
@@ -32,6 +32,17 @@ export interface FortinetProvisionPayload extends FortinetProvision {
32 integration_name: string
33 }
34
35 +export interface SonicwallProvision {
36 + tcp_enabled: boolean
37 + hot_data_retention: number
38 + index_replicas: number
39 +}
40 +
41 +export interface SonicwallProvisionPayload extends SonicwallProvision {
42 + customer_code: string
43 + integration_name: string
44 +}
45 +
46 export default {
47 // #region Network Connector
48 getAvailableNetworkConnectors() {
@@ -76,6 +87,14 @@ export default {
87 integration_name: networkConnectorName
88 }
89 return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/fortinet`, payload)
90 + },
91 + sonicwallProvision(customerCode: string, networkConnectorName: string, props: SonicwallProvision) {
92 + const payload: SonicwallProvisionPayload = {
93 + ...props,
94 + customer_code: customerCode,
95 + integration_name: networkConnectorName
96 + }
97 + return HttpClient.post<FlaskBaseResponse>(`/stack_provisioning/graylog/provision/sonicwall`, payload)
98 }
99 // #endregion
100 }
frontend/src/components/customers/networkConnectors/CustomerNetworkConnectorActions.vue
+203 -101
@@ -28,6 +28,20 @@
28 Deploy
29 </n-button>
30
31 + <n-button
32 + v-if="isSonicwall && !networkConnector.deployed"
33 + :loading="loadingSonicwallProvision"
34 + type="success"
35 + :size="size"
36 + secondary
37 + @click.stop="showSonicwallForm = true"
38 + >
39 + <template #icon>
40 + <Icon :name="DeployIcon" />
41 + </template>
42 + Deploy
43 + </n-button>
44 +
45 <n-button
46 v-if="!hideDeleteButton"
47 :size="size"
@@ -42,6 +56,7 @@
56 Delete
57 </n-button>
58
59 + <!-- Fortinet Modal -->
60 <n-modal
61 v-model:show="showFortinetForm"
62 preset="card"
@@ -72,32 +87,66 @@
87 </div>
88 </template>
89 </n-modal>
90 +
91 + <!-- SonicWall Modal -->
92 + <n-modal
93 + v-model:show="showSonicwallForm"
94 + preset="card"
95 + :style="{ maxWidth: 'min(420px, 90vw)', minHeight: 'min(300px, 90vh)', overflow: 'hidden' }"
96 + title="SonicWall options"
97 + :bordered="false"
98 + content-class="flex flex-col"
99 + segmented
100 + >
101 + <n-spin v-model:show="loadingSonicwallProvision">
102 + <SonicwallForm v-model:options="sonicwallOptions" />
103 + </n-spin>
104 +
105 + <template #footer>
106 + <div class="flex justify-end">
107 + <n-button
108 + :loading="loadingSonicwallProvision"
109 + type="success"
110 + secondary
111 + :disabled="!isSonicwallFormValid"
112 + @click.stop="sonicwallProvision()"
113 + >
114 + <template #icon>
115 + <Icon :name="DeployIcon" />
116 + </template>
117 + Deploy
118 + </n-button>
119 + </div>
120 + </template>
121 + </n-modal>
122 </div>
123 </template>
124
125 <script setup lang="ts">
126 import type { Size } from "naive-ui/es/button/src/interface"
127 import type { FortinetModel } from "./provisions/FortinetForm.vue"
81 -import type { FortinetProvision } from "@/api/endpoints/networkConnectors"
128 +import type { SonicwallModel } from "./provisions/SonicwallForm.vue"
129 +import type { FortinetProvision, SonicwallProvision } from "@/api/endpoints/networkConnectors"
130 import type { CustomerNetworkConnector } from "@/types/networkConnectors.d"
131 import { NButton, NModal, NSpin, useDialog, useMessage } from "naive-ui"
132 import { computed, h, ref, watch } from "vue"
133 import Api from "@/api"
134 import Icon from "@/components/common/Icon.vue"
135 import FortinetForm from "./provisions/FortinetForm.vue"
136 +import SonicwallForm from "./provisions/SonicwallForm.vue"
137
138 const { networkConnector, hideDeleteButton, size } = defineProps<{
90 - networkConnector: CustomerNetworkConnector
91 - hideDeleteButton?: boolean
92 - size?: Size
139 + networkConnector: CustomerNetworkConnector
140 + hideDeleteButton?: boolean
141 + size?: Size
142 }>()
143
144 const emit = defineEmits<{
96 - (e: "startLoading"): void
97 - (e: "stopLoading"): void
98 - (e: "deployed"): void
99 - (e: "decommissioned"): void
100 - (e: "deleted"): void
145 + (e: "startLoading"): void
146 + (e: "stopLoading"): void
147 + (e: "deployed"): void
148 + (e: "decommissioned"): void
149 + (e: "deleted"): void
150 }>()
151
152 const DeployIcon = "carbon:deploy"
@@ -107,125 +156,178 @@ const DecommissionIcon = "carbon:delete"
156 const dialog = useDialog()
157 const message = useMessage()
158 const loadingFortinetProvision = ref(false)
159 +const loadingSonicwallProvision = ref(false)
160 const loadingDelete = ref(false)
161 const loadingDecommission = ref(false)
112 -const loading = computed(() => loadingFortinetProvision.value || loadingDecommission.value || loadingDelete.value)
162 +const loading = computed(() =>
163 + loadingFortinetProvision.value ||
164 + loadingSonicwallProvision.value ||
165 + loadingDecommission.value ||
166 + loadingDelete.value
167 +)
168
169 const serviceName = computed(() => networkConnector.network_connector_service_name)
170 const customerCode = computed(() => networkConnector.customer_code)
171 const isFortinet = computed(() => serviceName.value === "Fortinet")
172 +const isSonicwall = computed(() => serviceName.value === "Sonicwall")
173
174 const showFortinetForm = ref(false)
175 +const showSonicwallForm = ref(false)
176
177 const fortinetOptions = ref<FortinetModel>({
121 - protocol: "tcp",
122 - hot_data_retention: 1,
123 - index_replicas: 0
178 + protocol: "tcp",
179 + hot_data_retention: 1,
180 + index_replicas: 0
181 +})
182 +
183 +const sonicwallOptions = ref<SonicwallModel>({
184 + protocol: "tcp",
185 + hot_data_retention: 1,
186 + index_replicas: 0
187 })
188
189 const isFortinetFormValid = computed(() => {
127 - if (fortinetOptions.value.hot_data_retention === null) {
128 - return false
129 - }
130 - if (fortinetOptions.value.index_replicas === null) {
131 - return false
132 - }
133 - return true
190 + if (fortinetOptions.value.hot_data_retention === null) {
191 + return false
192 + }
193 + if (fortinetOptions.value.index_replicas === null) {
194 + return false
195 + }
196 + return true
197 +})
198 +
199 +const isSonicwallFormValid = computed(() => {
200 + if (sonicwallOptions.value.hot_data_retention === null) {
201 + return false
202 + }
203 + if (sonicwallOptions.value.index_replicas === null) {
204 + return false
205 + }
206 + return true
207 })
208
209 watch(loading, val => {
137 - if (val) {
138 - emit("startLoading")
139 - } else {
140 - emit("stopLoading")
141 - }
210 + if (val) {
211 + emit("startLoading")
212 + } else {
213 + emit("stopLoading")
214 + }
215 })
216
217 function fortinetProvision() {
145 - loadingFortinetProvision.value = true
146 -
147 - const options: FortinetProvision = {
148 - tcp_enabled: fortinetOptions.value.protocol === "tcp",
149 - udp_enabled: fortinetOptions.value.protocol === "udp",
150 - hot_data_retention: fortinetOptions.value.hot_data_retention,
151 - index_replicas: fortinetOptions.value.index_replicas
152 - }
153 -
154 - Api.networkConnectors
155 - .fortinetProvision(customerCode.value, serviceName.value, options)
156 - .then(res => {
157 - if (res.data.success) {
158 - emit("deployed")
159 - message.success(res.data?.message || "Fortinet customer provisioned successfully.")
160 - } else {
161 - message.warning(res.data?.message || "An error occurred. Please try again later.")
162 - }
163 - })
164 - .catch(err => {
165 - message.error(err.response?.data?.message || "An error occurred. Please try again later.")
166 - })
167 - .finally(() => {
168 - loadingFortinetProvision.value = false
169 - })
218 + loadingFortinetProvision.value = true
219 +
220 + const options: FortinetProvision = {
221 + tcp_enabled: fortinetOptions.value.protocol === "tcp",
222 + udp_enabled: fortinetOptions.value.protocol === "udp",
223 + hot_data_retention: fortinetOptions.value.hot_data_retention,
224 + index_replicas: fortinetOptions.value.index_replicas
225 + }
226 +
227 + Api.networkConnectors
228 + .fortinetProvision(customerCode.value, serviceName.value, options)
229 + .then(res => {
230 + if (res.data.success) {
231 + emit("deployed")
232 + showFortinetForm.value = false
233 + message.success(res.data?.message || "Fortinet customer provisioned successfully.")
234 + } else {
235 + message.warning(res.data?.message || "An error occurred. Please try again later.")
236 + }
237 + })
238 + .catch(err => {
239 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
240 + })
241 + .finally(() => {
242 + loadingFortinetProvision.value = false
243 + })
244 +}
245 +
246 +function sonicwallProvision() {
247 + loadingSonicwallProvision.value = true
248 +
249 + const options: SonicwallProvision = {
250 + tcp_enabled: sonicwallOptions.value.protocol === "tcp",
251 + hot_data_retention: sonicwallOptions.value.hot_data_retention,
252 + index_replicas: sonicwallOptions.value.index_replicas
253 + }
254 +
255 + Api.networkConnectors
256 + .sonicwallProvision(customerCode.value, serviceName.value, options)
257 + .then(res => {
258 + if (res.data.success) {
259 + emit("deployed")
260 + showSonicwallForm.value = false
261 + message.success(res.data?.message || "SonicWall customer provisioned successfully.")
262 + } else {
263 + message.warning(res.data?.message || "An error occurred. Please try again later.")
264 + }
265 + })
266 + .catch(err => {
267 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
268 + })
269 + .finally(() => {
270 + loadingSonicwallProvision.value = false
271 + })
272 }
273
274 function handleDelete() {
173 - dialog.warning({
174 - title: "Confirm",
175 - content: () =>
176 - h("div", {
177 - innerHTML: `Are you sure you want to delete the Network Connector: <strong>${serviceName.value}</strong> ?`
178 - }),
179 - positiveText: "Yes I'm sure",
180 - negativeText: "Cancel",
181 - onPositiveClick: () => {
182 - deleteNetworkConnector()
183 - },
184 - onNegativeClick: () => {
185 - message.info("Delete canceled")
186 - }
187 - })
275 + dialog.warning({
276 + title: "Confirm",
277 + content: () =>
278 + h("div", {
279 + innerHTML: `Are you sure you want to delete the Network Connector: <strong>${serviceName.value}</strong> ?`
280 + }),
281 + positiveText: "Yes I'm sure",
282 + negativeText: "Cancel",
283 + onPositiveClick: () => {
284 + deleteNetworkConnector()
285 + },
286 + onNegativeClick: () => {
287 + message.info("Delete canceled")
288 + }
289 + })
290 }
291
292 function deleteNetworkConnector() {
191 - loadingDelete.value = true
192 -
193 - Api.networkConnectors
194 - .deleteNetworkConnector(customerCode.value, serviceName.value)
195 - .then(res => {
196 - if (res.data.success) {
197 - emit("deleted")
198 - message.success(res.data?.message || "Customer Network Connector successfully deleted.")
199 - } else {
200 - message.warning(res.data?.message || "An error occurred. Please try again later.")
201 - }
202 - })
203 - .catch(err => {
204 - message.error(err.response?.data?.message || "An error occurred. Please try again later.")
205 - })
206 - .finally(() => {
207 - loadingDelete.value = false
208 - })
293 + loadingDelete.value = true
294 +
295 + Api.networkConnectors
296 + .deleteNetworkConnector(customerCode.value, serviceName.value)
297 + .then(res => {
298 + if (res.data.success) {
299 + emit("deleted")
300 + message.success(res.data?.message || "Customer Network Connector successfully deleted.")
301 + } else {
302 + message.warning(res.data?.message || "An error occurred. Please try again later.")
303 + }
304 + })
305 + .catch(err => {
306 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
307 + })
308 + .finally(() => {
309 + loadingDelete.value = false
310 + })
311 }
312
313 function decommissionNetworkConnector() {
212 - loadingDecommission.value = true
213 -
214 - Api.networkConnectors
215 - .decommissionNetworkConnector(customerCode.value, serviceName.value)
216 - .then(res => {
217 - if (res.data.success) {
218 - emit("decommissioned")
219 - message.success(res.data?.message || "Customer Network Connector successfully decommissioned.")
220 - } else {
221 - message.warning(res.data?.message || "An error occurred. Please try again later.")
222 - }
223 - })
224 - .catch(err => {
225 - message.error(err.response?.data?.message || "An error occurred. Please try again later.")
226 - })
227 - .finally(() => {
228 - loadingDecommission.value = false
229 - })
314 + loadingDecommission.value = true
315 +
316 + Api.networkConnectors
317 + .decommissionNetworkConnector(customerCode.value, serviceName.value)
318 + .then(res => {
319 + if (res.data.success) {
320 + emit("decommissioned")
321 + message.success(res.data?.message || "Customer Network Connector successfully decommissioned.")
322 + } else {
323 + message.warning(res.data?.message || "An error occurred. Please try again later.")
324 + }
325 + })
326 + .catch(err => {
327 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
328 + })
329 + .finally(() => {
330 + loadingDecommission.value = false
331 + })
332 }
333 </script>
frontend/src/components/customers/networkConnectors/provisions/SonicwallForm.vue new
+29
@@ -0,0 +1,29 @@
1 +<template>
2 + <n-form :model="model" label-placement="left" label-width="auto">
3 + <n-form-item label="Protocol" required>
4 + <n-radio-group v-model:value="model.protocol">
5 + <n-radio-button value="tcp">TCP</n-radio-button>
6 + </n-radio-group>
7 + </n-form-item>
8 +
9 + <n-form-item label="Hot Data Retention (days)" required>
10 + <n-input-number v-model:value="model.hot_data_retention" :min="1" :max="90" class="w-full" />
11 + </n-form-item>
12 +
13 + <n-form-item label="Index Replicas" required>
14 + <n-input-number v-model:value="model.index_replicas" :min="0" :max="3" class="w-full" />
15 + </n-form-item>
16 + </n-form>
17 +</template>
18 +
19 +<script setup lang="ts">
20 +import { NForm, NFormItem, NInputNumber, NRadioButton, NRadioGroup } from "naive-ui"
21 +
22 +export interface SonicwallModel {
23 + protocol: "tcp"
24 + hot_data_retention: number
25 + index_replicas: number
26 +}
27 +
28 +const model = defineModel<SonicwallModel>("options", { required: true })
29 +</script>