{
  "annotations": {
    "list": []
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 1,
  "id": null,
  "links": [],
  "panels": [
    {
      "id": 1,
      "title": "Events im Zeitraum",
      "type": "stat",
      "gridPos": {
        "x": 0,
        "y": 0,
        "w": 6,
        "h": 4
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time)",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "orientation": "auto",
        "textMode": "auto",
        "colorMode": "value",
        "graphMode": "area"
      }
    },
    {
      "id": 2,
      "title": "Aktive Hosts",
      "type": "stat",
      "gridPos": {
        "x": 6,
        "y": 0,
        "w": 6,
        "h": 4
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT uniqExact(host_name) AS value FROM siem.events WHERE $__timeFilter(event_time)",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "orientation": "auto",
        "textMode": "auto",
        "colorMode": "value",
        "graphMode": "area"
      }
    },
    {
      "id": 3,
      "title": "Failed Logons",
      "type": "stat",
      "gridPos": {
        "x": 12,
        "y": 0,
        "w": 6,
        "h": 4
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "orientation": "auto",
        "textMode": "auto",
        "colorMode": "value",
        "graphMode": "area"
      }
    },
    {
      "id": 4,
      "title": "Account Lockouts",
      "type": "stat",
      "gridPos": {
        "x": 18,
        "y": 0,
        "w": 6,
        "h": 4
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4740",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "orientation": "auto",
        "textMode": "auto",
        "colorMode": "value",
        "graphMode": "area"
      }
    },
    {
      "id": 5,
      "title": "Event-Volumen",
      "type": "timeseries",
      "gridPos": {
        "x": 0,
        "y": 4,
        "w": 24,
        "h": 8
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "timeseries",
          "rawSql": "SELECT $__timeInterval(event_time) AS time, uniqExact(event_uid) AS events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY time ORDER BY time",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc"
        }
      }
    },
    {
      "id": 6,
      "title": "Top Hosts",
      "type": "table",
      "gridPos": {
        "x": 0,
        "y": 12,
        "w": 12,
        "h": 8
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT host_name AS Host, uniqExact(event_uid) AS Events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY host_name ORDER BY Events DESC LIMIT 20",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "showHeader": true,
        "cellHeight": "sm"
      }
    },
    {
      "id": 7,
      "title": "Top Event-IDs",
      "type": "table",
      "gridPos": {
        "x": 12,
        "y": 12,
        "w": 12,
        "h": 8
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT event_code AS EventID, uniqExact(event_uid) AS Events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY event_code ORDER BY Events DESC LIMIT 20",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "showHeader": true,
        "cellHeight": "sm"
      }
    },
    {
      "id": 8,
      "title": "Authentication Events",
      "type": "timeseries",
      "gridPos": {
        "x": 0,
        "y": 20,
        "w": 24,
        "h": 8
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "timeseries",
          "rawSql": "SELECT $__timeInterval(event_time) AS time, toString(event_code) AS event, uniqExact(event_uid) AS events FROM siem.events WHERE $__timeFilter(event_time) AND event_code IN (4624,4625,4740,4771,4776) GROUP BY time,event ORDER BY time",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "legend": {
          "displayMode": "list",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "desc"
        }
      }
    },
    {
      "id": 9,
      "title": "Top fehlgeschlagene Benutzer",
      "type": "table",
      "gridPos": {
        "x": 0,
        "y": 28,
        "w": 12,
        "h": 8
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT target_user AS User, uniqExact(event_uid) AS Failures, uniqExact(source_ip) AS SourceIPs FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625 AND target_user!='' GROUP BY target_user ORDER BY Failures DESC LIMIT 25",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "showHeader": true,
        "cellHeight": "sm"
      }
    },
    {
      "id": 10,
      "title": "Top Source-IPs bei 4625",
      "type": "table",
      "gridPos": {
        "x": 12,
        "y": 28,
        "w": 12,
        "h": 8
      },
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "siem-clickhouse"
      },
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "siem-clickhouse"
          },
          "editorType": "sql",
          "format": 0,
          "queryType": "table",
          "rawSql": "SELECT source_ip AS SourceIP, uniqExact(event_uid) AS Failures, uniqExact(target_user) AS Users FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625 AND source_ip!='' GROUP BY source_ip ORDER BY Failures DESC LIMIT 25",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "short",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "options": {
        "showHeader": true,
        "cellHeight": "sm"
      }
    }
  ],
  "refresh": "30s",
  "schemaVersion": 42,
  "tags": [
    "siem",
    "security",
    "clickhouse"
  ],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timezone": "browser",
  "title": "SIEM Security Overview",
  "uid": "siem-security-overview",
  "version": 1
}