309 lines
8.1 KiB
JSON
309 lines
8.1 KiB
JSON
{
|
|
"apiVersion": "dashboard.grafana.app/v1beta1",
|
|
"kind": "Dashboard",
|
|
"metadata": {
|
|
"name": "truenas-audit-overview"
|
|
},
|
|
"spec": {
|
|
"annotations": {
|
|
"list": [
|
|
{
|
|
"builtIn": 1,
|
|
"datasource": {
|
|
"type": "grafana",
|
|
"uid": "-- Grafana --"
|
|
},
|
|
"enable": true,
|
|
"hide": true,
|
|
"iconColor": "rgba(0, 211, 255, 1)",
|
|
"name": "Annotations & Alerts",
|
|
"type": "dashboard"
|
|
}
|
|
]
|
|
},
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 0,
|
|
"links": [],
|
|
"panels": [
|
|
{
|
|
"datasource": null,
|
|
"gridPos": {
|
|
"h": 5,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 0
|
|
},
|
|
"id": 1,
|
|
"options": {
|
|
"content": "# TrueNAS Audit Overview\n\nNative TrueNAS audit events from remote syslog, parsed in Alloy, and stored in Loki as `job=\"truenas_syslog\"`.\n\n[Open Audit Logs Panel](#/viewPanel=4)\n\n## Quick Checks\n```bash\n# dns host (receiver)\nsudo systemctl status alloy --no-pager\nsudo tail -n 50 /var/log/truenas/truenas-syslog.log\n\n# truenas host (sender)\nmidclt call system.advanced.config | jq '{syslogserver,syslog_transport,syslog_audit,syslog_tls_certificate,sed_user}'\n```\n",
|
|
"mode": "markdown"
|
|
},
|
|
"pluginVersion": "12.2.1",
|
|
"targets": [],
|
|
"title": "Status",
|
|
"type": "text"
|
|
},
|
|
{
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"decimals": 0,
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": 0
|
|
},
|
|
{
|
|
"color": "orange",
|
|
"value": 1
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 10
|
|
}
|
|
]
|
|
},
|
|
"unit": "short"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 5,
|
|
"w": 8,
|
|
"x": 0,
|
|
"y": 5
|
|
},
|
|
"id": 2,
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"percentChangeColorMode": "standard",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showPercentChange": false,
|
|
"textMode": "auto",
|
|
"wideLayout": true
|
|
},
|
|
"pluginVersion": "12.2.1",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "ef1qnibjxb5z4a"
|
|
},
|
|
"expr": "sum(count_over_time({job=\\\"truenas_syslog\\\",host=~\\\"$host\\\",svc=~\\\"$svc\\\"}[5m]))",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Audit Related Events (5m)",
|
|
"type": "stat"
|
|
},
|
|
{
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisColorMode": "text",
|
|
"axisLabel": "",
|
|
"axisPlacement": "auto",
|
|
"barAlignment": 0,
|
|
"barWidthFactor": 0.6,
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"gradientMode": "none",
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
},
|
|
"insertNulls": false,
|
|
"lineInterpolation": "linear",
|
|
"lineWidth": 1,
|
|
"pointSize": 5,
|
|
"scaleDistribution": {
|
|
"type": "linear"
|
|
},
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "none"
|
|
},
|
|
"thresholdsStyle": {
|
|
"mode": "off"
|
|
}
|
|
},
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": 0
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 1
|
|
}
|
|
]
|
|
},
|
|
"unit": "short"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 8,
|
|
"w": 16,
|
|
"x": 8,
|
|
"y": 5
|
|
},
|
|
"id": 3,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"hideZeros": false,
|
|
"mode": "single",
|
|
"sort": "none"
|
|
}
|
|
},
|
|
"pluginVersion": "12.2.1",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "ef1qnibjxb5z4a"
|
|
},
|
|
"expr": "sum(count_over_time({job=\\\"truenas_syslog\\\",host=~\\\"$host\\\",svc=~\\\"$svc\\\",success=\\\"false\\\"}[5m]))",
|
|
"legendFormat": "Failures",
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "ef1qnibjxb5z4a"
|
|
},
|
|
"expr": "sum(count_over_time({job=\\\"truenas_syslog\\\",host=~\\\"$host\\\",svc=~\\\"SUDO|SYSTEM\\\"}[5m]))",
|
|
"legendFormat": "Privileged Actions",
|
|
"refId": "B"
|
|
}
|
|
],
|
|
"title": "Security Event Rates",
|
|
"type": "timeseries"
|
|
},
|
|
{
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 11,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 13
|
|
},
|
|
"id": 4,
|
|
"options": {
|
|
"showCommonLabels": false,
|
|
"showLabels": true,
|
|
"showTime": true,
|
|
"wrapLogMessage": true
|
|
},
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "ef1qnibjxb5z4a"
|
|
},
|
|
"expr": "{job=\\\"truenas_syslog\\\",host=~\\\"$host\\\",svc=~\\\"$svc\\\"}",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"title": "Audit / Security Logs",
|
|
"type": "logs"
|
|
}
|
|
],
|
|
"preload": false,
|
|
"refresh": "30s",
|
|
"schemaVersion": 42,
|
|
"tags": [
|
|
"truenas",
|
|
"audit",
|
|
"security",
|
|
"loki"
|
|
],
|
|
"templating": {
|
|
"list": [
|
|
{
|
|
"name": "host",
|
|
"type": "query",
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "ef1qnibjxb5z4a"
|
|
},
|
|
"definition": "label_values({job=\"truenas_syslog\"}, host)",
|
|
"query": "label_values({job=\"truenas_syslog\"}, host)",
|
|
"refresh": 1,
|
|
"sort": 1,
|
|
"includeAll": true,
|
|
"allValue": ".*",
|
|
"multi": false,
|
|
"current": {
|
|
"text": "All",
|
|
"value": "$__all",
|
|
"selected": true
|
|
}
|
|
},
|
|
{
|
|
"name": "svc",
|
|
"type": "query",
|
|
"query": "label_values({job=\\\"truenas_syslog\\\",host=~\\\"$host\\\"}, svc)",
|
|
"includeAll": true,
|
|
"allValue": ".*",
|
|
"multi": false,
|
|
"current": {
|
|
"text": "All",
|
|
"value": "$__all",
|
|
"selected": true
|
|
},
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "ef1qnibjxb5z4a"
|
|
},
|
|
"definition": "label_values({job=\\\"truenas_syslog\\\",host=~\\\"$host\\\"}, svc)",
|
|
"refresh": 1,
|
|
"sort": 1
|
|
}
|
|
]
|
|
},
|
|
"time": {
|
|
"from": "now-6h",
|
|
"to": "now"
|
|
},
|
|
"timepicker": {},
|
|
"timezone": "browser",
|
|
"title": "TrueNAS Audit Overview"
|
|
}
|
|
}
|