550 lines
13 KiB
JSON
550 lines
13 KiB
JSON
{
|
|
"annotations": {
|
|
"list": []
|
|
},
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 1,
|
|
"id": null,
|
|
"links": [],
|
|
"panels": [
|
|
{
|
|
"id": 1,
|
|
"title": "Events im Zeitraum",
|
|
"type": "stat",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 0,
|
|
"w": 6,
|
|
"h": 4
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time)",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"orientation": "auto",
|
|
"textMode": "auto",
|
|
"colorMode": "value",
|
|
"graphMode": "area"
|
|
}
|
|
},
|
|
{
|
|
"id": 2,
|
|
"title": "Aktive Hosts",
|
|
"type": "stat",
|
|
"gridPos": {
|
|
"x": 6,
|
|
"y": 0,
|
|
"w": 6,
|
|
"h": 4
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT uniqExact(host_name) AS value FROM siem.events WHERE $__timeFilter(event_time)",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"orientation": "auto",
|
|
"textMode": "auto",
|
|
"colorMode": "value",
|
|
"graphMode": "area"
|
|
}
|
|
},
|
|
{
|
|
"id": 3,
|
|
"title": "Failed Logons",
|
|
"type": "stat",
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 0,
|
|
"w": 6,
|
|
"h": 4
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"orientation": "auto",
|
|
"textMode": "auto",
|
|
"colorMode": "value",
|
|
"graphMode": "area"
|
|
}
|
|
},
|
|
{
|
|
"id": 4,
|
|
"title": "Account Lockouts",
|
|
"type": "stat",
|
|
"gridPos": {
|
|
"x": 18,
|
|
"y": 0,
|
|
"w": 6,
|
|
"h": 4
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4740",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"orientation": "auto",
|
|
"textMode": "auto",
|
|
"colorMode": "value",
|
|
"graphMode": "area"
|
|
}
|
|
},
|
|
{
|
|
"id": 5,
|
|
"title": "Event-Volumen",
|
|
"type": "timeseries",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 4,
|
|
"w": 24,
|
|
"h": 8
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "timeseries",
|
|
"rawSql": "SELECT $__timeInterval(event_time) AS time, uniqExact(event_uid) AS events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY time ORDER BY time",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"id": 6,
|
|
"title": "Top Hosts",
|
|
"type": "table",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 12,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT host_name AS Host, uniqExact(event_uid) AS Events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY host_name ORDER BY Events DESC LIMIT 20",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"showHeader": true,
|
|
"cellHeight": "sm"
|
|
}
|
|
},
|
|
{
|
|
"id": 7,
|
|
"title": "Top Event-IDs",
|
|
"type": "table",
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 12,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT event_code AS EventID, uniqExact(event_uid) AS Events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY event_code ORDER BY Events DESC LIMIT 20",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"showHeader": true,
|
|
"cellHeight": "sm"
|
|
}
|
|
},
|
|
{
|
|
"id": 8,
|
|
"title": "Authentication Events",
|
|
"type": "timeseries",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 20,
|
|
"w": 24,
|
|
"h": 8
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "timeseries",
|
|
"rawSql": "SELECT $__timeInterval(event_time) AS time, toString(event_code) AS event, uniqExact(event_uid) AS events FROM siem.events WHERE $__timeFilter(event_time) AND event_code IN (4624,4625,4740,4771,4776) GROUP BY time,event ORDER BY time",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"id": 9,
|
|
"title": "Top fehlgeschlagene Benutzer",
|
|
"type": "table",
|
|
"gridPos": {
|
|
"x": 0,
|
|
"y": 28,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT target_user AS User, uniqExact(event_uid) AS Failures, uniqExact(source_ip) AS SourceIPs FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625 AND target_user!='' GROUP BY target_user ORDER BY Failures DESC LIMIT 25",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"showHeader": true,
|
|
"cellHeight": "sm"
|
|
}
|
|
},
|
|
{
|
|
"id": 10,
|
|
"title": "Top Source-IPs bei 4625",
|
|
"type": "table",
|
|
"gridPos": {
|
|
"x": 12,
|
|
"y": 28,
|
|
"w": 12,
|
|
"h": 8
|
|
},
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "grafana-clickhouse-datasource",
|
|
"uid": "siem-clickhouse"
|
|
},
|
|
"editorType": "sql",
|
|
"format": 0,
|
|
"queryType": "table",
|
|
"rawSql": "SELECT source_ip AS SourceIP, uniqExact(event_uid) AS Failures, uniqExact(target_user) AS Users FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625 AND source_ip!='' GROUP BY source_ip ORDER BY Failures DESC LIMIT 25",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"options": {
|
|
"showHeader": true,
|
|
"cellHeight": "sm"
|
|
}
|
|
}
|
|
],
|
|
"refresh": "30s",
|
|
"schemaVersion": 42,
|
|
"tags": [
|
|
"siem",
|
|
"security",
|
|
"clickhouse"
|
|
],
|
|
"templating": {
|
|
"list": []
|
|
},
|
|
"time": {
|
|
"from": "now-24h",
|
|
"to": "now"
|
|
},
|
|
"timezone": "browser",
|
|
"title": "SIEM Security Overview",
|
|
"uid": "siem-security-overview",
|
|
"version": 1
|
|
} |