{ "version": 5, "dashboardId": "7326650010307661466", "title": "Fortinet", "description": "", "role": "", "owner": "", "created": "2025-05-09T17:18:59.856Z", "tabs": [ { "tabId": "default", "name": "Executive Summary", "panels": [ { "id": "Panel_ID8843710", "type": "metric", "title": "Total Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\"", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 0, "w": 7, "h": 6, "i": 1, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9591510", "type": "metric", "title": "Total Critical Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('critical')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "critical" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 7, "y": 0, "w": 8, "h": 6, "i": 2, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9974310", "type": "metric", "title": "Total Elevated Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('elevated')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "elevated" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 15, "y": 0, "w": 9, "h": 6, "i": 3, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9011110", "type": "metric", "title": "Total High Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('high')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "high" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 0, "w": 9, "h": 6, "i": 4, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID4959210", "type": "metric", "title": "Total Medium Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('medium')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "medium" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 33, "y": 0, "w": 8, "h": 6, "i": 5, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID534310", "type": "metric", "title": "Total Low Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('low')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "low" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 41, "y": 0, "w": 7, "h": 6, "i": 6, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID5711010", "type": "metric", "title": "Problematic Source IPs", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(cef_src) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('critical', 'elevated')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Cef Src", "alias": "y_axis_1", "column": "cef_src", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "critical", "elevated" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 6, "w": 12, "h": 7, "i": 7, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID7820010", "type": "metric", "title": "Problematic Destination IPs", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(cef_dst) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('critical', 'elevated')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Cef Dst", "alias": "y_axis_1", "column": "cef_dst", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "critical", "elevated" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 12, "y": 6, "w": 12, "h": 7, "i": 8, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID2221910", "type": "metric", "title": "Total Allowed Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtutmaction IN ('allow')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "allow" ], "column": "cef_ftntfgtutmaction", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 6, "w": 12, "h": 7, "i": 9, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID239010", "type": "metric", "title": "Total Blocked Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtutmaction IN ('block')", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "block" ], "column": "cef_ftntfgtutmaction", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 36, "y": 6, "w": 12, "h": 7, "i": 10, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID1326110", "type": "gauge", "title": "Policy Level Events", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtpolicyname as \"x_axis_1\", count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtpolicyname", "alias": "x_axis_1", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 13, "w": 24, "h": 11, "i": 11, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9343110", "type": "gauge", "title": "Policy Level Events - critical", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "fixed", "fixedColor": [ "#f8121d" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtpolicyname as \"x_axis_1\", count(_timestamp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('critical') GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtpolicyname", "alias": "x_axis_1", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Timestamp", "alias": "y_axis_1", "column": "_timestamp", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "critical" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 13, "w": 24, "h": 11, "i": 12, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " } ] }, { "tabId": "14414", "name": "Network Traffic Overview", "panels": [ { "id": "Panel_ID3562810", "type": "area", "title": "Inbound Interface", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT histogram(_timestamp) as \"x_axis_1\", count(cef_deviceinboundinterface) as \"y_axis_1\", cef_deviceinboundinterface as \"breakdown_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1, breakdown_1 ORDER BY x_axis_1 ASC, y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Timestamp", "alias": "x_axis_1", "column": "_timestamp", "color": null, "aggregationFunction": "histogram", "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Deviceinboundinterface", "alias": "y_axis_1", "column": "cef_deviceinboundinterface", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [ { "label": "Cef Deviceinboundinterface", "alias": "breakdown_1", "column": "cef_deviceinboundinterface", "color": null, "isDerived": false, "havingConditions": [] } ], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 9, "w": 24, "h": 9, "i": 1, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID4591710", "type": "area", "title": "Outbound Interface", "description": "", "config": { "show_legends": true, "legends_position": "bottom", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT histogram(_timestamp) as \"x_axis_1\", count(cef_deviceoutboundinterface) as \"y_axis_1\", cef_deviceoutboundinterface as \"breakdown_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1, breakdown_1 ORDER BY x_axis_1 ASC, y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Timestamp", "alias": "x_axis_1", "column": "_timestamp", "color": null, "aggregationFunction": "histogram", "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Deviceoutboundinterface", "alias": "y_axis_1", "column": "cef_deviceoutboundinterface", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [ { "label": "Cef Deviceoutboundinterface", "alias": "breakdown_1", "column": "cef_deviceoutboundinterface", "color": null, "isDerived": false, "havingConditions": [] } ], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 0, "w": 24, "h": 9, "i": 2, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID321210", "type": "area", "title": "Bytes In", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "bytes", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT histogram(_timestamp) as \"x_axis_1\", count(cef_in) as \"y_axis_1\", cef_deviceoutboundinterface as \"breakdown_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1, breakdown_1 ORDER BY x_axis_1 ASC, y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Timestamp", "alias": "x_axis_1", "column": "_timestamp", "color": null, "aggregationFunction": "histogram", "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef In", "alias": "y_axis_1", "column": "cef_in", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [ { "label": "Cef Deviceoutboundinterface", "alias": "breakdown_1", "column": "cef_deviceoutboundinterface", "color": null, "isDerived": false, "havingConditions": [] } ], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 9, "w": 24, "h": 9, "i": 3, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID5874110", "type": "table", "title": "Source to Destination for Out Bytes", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "bytes", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_src as \"x_axis_1\", cef_dst as \"x_axis_2\", count(cef_out) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_src IS NOT NULL GROUP BY x_axis_1, x_axis_2 ORDER BY y_axis_1 DESC LIMIT 10", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Source IP", "alias": "x_axis_1", "column": "cef_src", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Destination IP", "alias": "x_axis_2", "column": "cef_dst", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Out", "alias": "y_axis_1", "column": "cef_out", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_src", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 10, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 0, "w": 24, "h": 9, "i": 4, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID8162310", "type": "geomap", "title": "Geo for Bytes In", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "bytes", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT geo_latitude as latitude, geo_longitude as longitude, count(cef_in) as weight FROM \"fortinet_fw_syslog\" GROUP BY latitude, longitude", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [], "z": [], "breakdown": [], "latitude": { "label": "Geo Latitude", "alias": "latitude", "column": "geo_latitude", "color": "#5960b2", "isDerived": false, "havingConditions": [] }, "longitude": { "label": "Geo Longitude", "alias": "longitude", "column": "geo_longitude", "color": "#5960b2", "isDerived": false, "havingConditions": [] }, "weight": { "label": "Cef In", "alias": "weight", "column": "cef_in", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] }, "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 18, "w": 24, "h": 9, "i": 5, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " } ] }, { "tabId": "41179", "name": "Application Usage & Control Dashboard", "panels": [ { "id": "Panel_ID2933710", "type": "pie", "title": "app category", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtappcat as \"x_axis_1\", count(cef_ftntfgtappcat) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtappcat", "alias": "x_axis_1", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtappcat", "alias": "y_axis_1", "column": "cef_ftntfgtappcat", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 9, "w": 24, "h": 9, "i": 1, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID6541210", "type": "area", "title": "app category trend", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT histogram(_timestamp) as \"x_axis_1\", count(cef_ftntfgtappcat) as \"y_axis_1\", cef_ftntfgtappcat as \"breakdown_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1, breakdown_1 ORDER BY x_axis_1 ASC, y_axis_1 DESC, breakdown_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Timestamp", "alias": "x_axis_1", "column": "_timestamp", "color": null, "aggregationFunction": "histogram", "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtappcat", "alias": "y_axis_1", "column": "cef_ftntfgtappcat", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [ { "label": "Cef Ftntfgtappcat", "alias": "breakdown_1", "column": "cef_ftntfgtappcat", "color": null, "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 9, "w": 24, "h": 9, "i": 2, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID2971110", "type": "pie", "title": "app name", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtapp as \"x_axis_1\", count(cef_ftntfgtapp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtapp", "alias": "x_axis_1", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtapp", "alias": "y_axis_1", "column": "cef_ftntfgtapp", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 18, "w": 24, "h": 9, "i": 3, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID6877710", "type": "area", "title": "app name trend", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": true, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT histogram(_timestamp) as \"x_axis_1\", count(cef_ftntfgtapp) as \"y_axis_1\", cef_ftntfgtapp as \"breakdown_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1, breakdown_1 ORDER BY x_axis_1 ASC, y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Timestamp", "alias": "x_axis_1", "column": "_timestamp", "color": null, "aggregationFunction": "histogram", "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtapp", "alias": "y_axis_1", "column": "cef_ftntfgtapp", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [ { "label": "Cef Ftntfgtapp", "alias": "breakdown_1", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] } ], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 18, "w": 24, "h": 9, "i": 4, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID8563110", "type": "table", "title": "Top 20 elevated apps", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtapp as \"x_axis_1\", cef_ftntfgtappcat as \"x_axis_2\", cef_ftntfgtapprisk as \"x_axis_3\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IS NOT NULL AND cef_ftntfgtapprisk LIKE '%elevated%' ORDER BY x_axis_3 ASC LIMIT 20", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "app name", "alias": "x_axis_1", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app category", "alias": "x_axis_2", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "risk level", "alias": "x_axis_3", "column": "cef_ftntfgtapprisk", "color": null, "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Contains", "value": "elevated", "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 20, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 0, "w": 24, "h": 9, "i": 5, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9255410", "type": "table", "title": "Top 20 critical apps", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtapp as \"x_axis_1\", cef_ftntfgtappcat as \"x_axis_2\", cef_ftntfgtapprisk as \"x_axis_3\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IS NOT NULL AND cef_ftntfgtapprisk LIKE '%critical%' ORDER BY x_axis_3 ASC LIMIT 20", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "app name", "alias": "x_axis_1", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app category", "alias": "x_axis_2", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "risk level", "alias": "x_axis_3", "column": "cef_ftntfgtapprisk", "color": null, "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Contains", "value": "critical", "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 20, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 0, "w": 24, "h": 9, "i": 6, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID3691310", "type": "pie", "title": "Elevated app categories", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtappcat as \"x_axis_1\", count(cef_ftntfgtappcat) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IS NOT NULL AND cef_ftntfgtapprisk LIKE '%elevated%' GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "app category", "alias": "x_axis_1", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtappcat", "alias": "y_axis_1", "column": "cef_ftntfgtappcat", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Contains", "value": "elevated", "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 27, "w": 24, "h": 9, "i": 7, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID7270110", "type": "pie", "title": "Critical app categories", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtappcat as \"x_axis_1\", count(cef_ftntfgtappcat) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IS NOT NULL AND cef_ftntfgtapprisk LIKE '%critical%' GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "app category", "alias": "x_axis_1", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtappcat", "alias": "y_axis_1", "column": "cef_ftntfgtappcat", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Contains", "value": "critical", "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 27, "w": 24, "h": 9, "i": 8, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID6980610", "type": "table", "title": "Top 20 blocked apps", "description": "", "config": { "show_legends": true, "legends_position": "right", "decimals": 2, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtapplist as \"x_axis_1\", cef_ftntfgtapp as \"x_axis_2\", cef_ftntfgtutmaction as \"x_axis_3\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtutmaction LIKE '%block%' LIMIT 20", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtapplist", "alias": "x_axis_1", "column": "cef_ftntfgtapplist", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Cef Ftntfgtapp", "alias": "x_axis_2", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Cef Ftntfgtutmaction", "alias": "x_axis_3", "column": "cef_ftntfgtutmaction", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtutmaction", "operator": "Contains", "value": "block", "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 20, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 36, "w": 24, "h": 9, "i": 9, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID5813110", "type": "h-bar", "title": "Top 20 blocked apps", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtapp as \"x_axis_1\", count(cef_act) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtutmaction LIKE '%block%' GROUP BY x_axis_1 ORDER BY y_axis_1 DESC LIMIT 20", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtapp", "alias": "x_axis_1", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Act", "alias": "y_axis_1", "column": "cef_act", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtutmaction", "operator": "Contains", "value": "block", "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 20, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 36, "w": 24, "h": 9, "i": 10, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " } ] }, { "tabId": "56444", "name": "Security Policy Performance", "panels": [ { "id": "Panel_ID5744310", "type": "pie", "title": "Policy Activity", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtpolicyname as \"x_axis_1\", count(cef_ftntfgtpolicyid) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtpolicyname", "alias": "x_axis_1", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtpolicyid", "alias": "y_axis_1", "column": "cef_ftntfgtpolicyid", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 0, "w": 24, "h": 9, "i": 1, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID4397310", "type": "pie", "title": "Policy Activity", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtutmaction as \"x_axis_1\", count(cef_ftntfgtpolicyname) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtutmaction", "alias": "x_axis_1", "column": "cef_ftntfgtutmaction", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtpolicyname", "alias": "y_axis_1", "column": "cef_ftntfgtpolicyname", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 0, "w": 24, "h": 9, "i": 2, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9789010", "type": "table", "title": "Immediate: Allowed actions that are critical", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [ { "type": "value", "value": "critical", "color": "#fc0808", "text": "" } ], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtpolicyname as \"x_axis_1\", cef_ftntfgtappcat as \"x_axis_2\", cef_ftntfgtutmaction as \"x_axis_3\", cef_ftntfgtapprisk as \"x_axis_4\", count(cef_ftntfgtpolicyname) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('critical') AND cef_ftntfgtutmaction IN ('allow') GROUP BY x_axis_1, x_axis_2, x_axis_3, x_axis_4 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "policy name", "alias": "x_axis_1", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app category", "alias": "x_axis_2", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "action", "alias": "x_axis_3", "column": "cef_ftntfgtutmaction", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "risk", "alias": "x_axis_4", "column": "cef_ftntfgtapprisk", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "policy name #", "alias": "y_axis_1", "column": "cef_ftntfgtpolicyname", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "critical" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "list", "values": [ "allow" ], "column": "cef_ftntfgtutmaction", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 9, "w": 24, "h": 9, "i": 3, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID3747910", "type": "table", "title": "Immediate: Allowed actions that are elevated", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [ { "type": "value", "value": "elevated", "color": "#e33232", "text": "" } ], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtpolicyname as \"x_axis_1\", cef_ftntfgtappcat as \"x_axis_2\", cef_ftntfgtutmaction as \"x_axis_3\", cef_ftntfgtapprisk as \"x_axis_4\", count(cef_ftntfgtpolicyname) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('elevated') AND cef_ftntfgtutmaction IN ('allow') GROUP BY x_axis_1, x_axis_2, x_axis_3, x_axis_4 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "policy name", "alias": "x_axis_1", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app category", "alias": "x_axis_2", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "action", "alias": "x_axis_3", "column": "cef_ftntfgtutmaction", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "risk", "alias": "x_axis_4", "column": "cef_ftntfgtapprisk", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "policy name #", "alias": "y_axis_1", "column": "cef_ftntfgtpolicyname", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "elevated" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "list", "values": [ "allow" ], "column": "cef_ftntfgtutmaction", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 9, "w": 24, "h": 9, "i": 4, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID5919910", "type": "table", "title": "Severity levels", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [ { "type": "value", "value": "critical", "color": "#fc0808", "text": "" } ], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtpolicyname as \"x_axis_1\", cef_act as \"x_axis_2\", cef_severity as \"x_axis_3\", count(cef_ftntfgtpolicyname) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtpolicyname IS NOT NULL GROUP BY x_axis_1, x_axis_2, x_axis_3 ORDER BY x_axis_3 DESC, y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "policy name", "alias": "x_axis_1", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "action", "alias": "x_axis_2", "column": "cef_act", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "severity", "alias": "x_axis_3", "column": "cef_severity", "color": null, "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "policy name #", "alias": "y_axis_1", "column": "cef_ftntfgtpolicyname", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtpolicyname", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 18, "w": 24, "h": 9, "i": 5, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " } ] }, { "tabId": "33868", "name": "Threat Intelligence", "panels": [ { "id": "Panel_ID5704610", "type": "pie", "title": "Severity Distribution", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtapprisk as \"x_axis_1\", count(cef_severity) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1 ORDER BY x_axis_1 ASC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtapprisk", "alias": "x_axis_1", "column": "cef_ftntfgtapprisk", "color": null, "sortBy": "ASC", "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Severity", "alias": "y_axis_1", "column": "cef_severity", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 0, "w": 24, "h": 9, "i": 1, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID8893110", "type": "geomap", "title": "Geographical Threat Map", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT geo_latitude as latitude, geo_longitude as longitude, count(cef_ftntfgtapprisk) as weight FROM \"fortinet_fw_syslog\" GROUP BY latitude, longitude", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [], "y": [], "z": [], "breakdown": [], "latitude": { "label": "Geo Latitude", "alias": "latitude", "column": "geo_latitude", "color": "#5960b2", "isDerived": false, "havingConditions": [] }, "longitude": { "label": "Geo Longitude", "alias": "longitude", "column": "geo_longitude", "color": "#5960b2", "isDerived": false, "havingConditions": [] }, "weight": { "label": "Cef Ftntfgtapprisk", "alias": "weight", "column": "cef_ftntfgtapprisk", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] }, "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 0, "w": 24, "h": 9, "i": 2, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID3896410", "type": "gauge", "title": "Severity Distribution count by category", "description": "", "config": { "show_legends": true, "legends_position": "right", "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_ftntfgtappcat as \"x_axis_1\", count(cef_severity) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" GROUP BY x_axis_1 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Cef Ftntfgtappcat", "alias": "x_axis_1", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Severity", "alias": "y_axis_1", "column": "cef_severity", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 9, "w": 48, "h": 15, "i": 3, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " } ] }, { "tabId": "35643", "name": "User Behavior Analytics", "panels": [ { "id": "Panel_ID4980110", "type": "table", "title": "source ip to app (critical)", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_src as \"x_axis_1\", cef_ftntfgtsrcuuid as \"x_axis_2\", cef_ftntfgtapp as \"x_axis_3\", count(cef_src) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtsrcuuid IS NOT NULL AND cef_ftntfgtapprisk IN ('critical') GROUP BY x_axis_1, x_axis_2, x_axis_3 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "source ip", "alias": "x_axis_1", "column": "cef_src", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "uuid", "alias": "x_axis_2", "column": "cef_ftntfgtsrcuuid", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app", "alias": "x_axis_3", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Src", "alias": "y_axis_1", "column": "cef_src", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtsrcuuid", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "list", "values": [ "critical" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 0, "w": 24, "h": 9, "i": 2, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID9737310", "type": "table", "title": "source ip to app (elevated)", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_src as \"x_axis_1\", cef_ftntfgtsrcuuid as \"x_axis_2\", cef_ftntfgtapp as \"x_axis_3\", count(cef_src) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtsrcuuid IS NOT NULL AND cef_ftntfgtapprisk IN ('elevated') GROUP BY x_axis_1, x_axis_2, x_axis_3 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "source ip", "alias": "x_axis_1", "column": "cef_src", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "uuid", "alias": "x_axis_2", "column": "cef_ftntfgtsrcuuid", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app", "alias": "x_axis_3", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Src", "alias": "y_axis_1", "column": "cef_src", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtsrcuuid", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "list", "values": [ "elevated" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 0, "w": 24, "h": 9, "i": 3, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID6872410", "type": "table", "title": "risk level per IP", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [ { "type": "value", "value": "critical", "color": "#fa0c0c", "text": "" }, { "type": "value", "value": "elevated", "color": "#f5900c", "text": "" }, { "type": "value", "value": "medium", "color": "#b88932", "text": "" }, { "type": "value", "value": "high", "color": "#ebff91", "text": "" }, { "type": "value", "value": "low", "color": "#07f22b", "text": "" } ], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_src as \"x_axis_1\", cef_ftntfgtapprisk as \"x_axis_2\", cef_ftntfgtappcat as \"x_axis_3\", cef_act as \"x_axis_4\", count(cef_ftntfgtapprisk) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IS NOT NULL GROUP BY x_axis_1, x_axis_2, x_axis_3, x_axis_4 ORDER BY x_axis_2 ASC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "source ip", "alias": "x_axis_1", "column": "cef_src", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "risk level", "alias": "x_axis_2", "column": "cef_ftntfgtapprisk", "color": null, "sortBy": "ASC", "isDerived": false, "havingConditions": [] }, { "label": "app category", "alias": "x_axis_3", "column": "cef_ftntfgtappcat", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "action", "alias": "x_axis_4", "column": "cef_act", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "Cef Ftntfgtapprisk", "alias": "y_axis_1", "column": "cef_ftntfgtapprisk", "color": "#5960b2", "aggregationFunction": "count", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_ftntfgtapprisk", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 9, "w": 24, "h": 9, "i": 4, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID4910510", "type": "table", "title": "sensitive data (critical) traffic", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [ { "type": "value", "value": "critical", "color": "#fa0c0c", "text": "" }, { "type": "value", "value": "elevated", "color": "#f5900c", "text": "" }, { "type": "value", "value": "medium", "color": "#b88932", "text": "" }, { "type": "value", "value": "high", "color": "#ebff91", "text": "" }, { "type": "value", "value": "low", "color": "#07f22b", "text": "" } ], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_src as \"x_axis_1\", cef_dst as \"x_axis_2\", cef_ftntfgtapp as \"x_axis_3\", cef_ftntfgtpolicyname as \"x_axis_4\", count(cef_ftntfgtapp) as \"y_axis_1\" FROM \"fortinet_fw_syslog\" WHERE cef_ftntfgtapprisk IN ('critical') GROUP BY x_axis_1, x_axis_2, x_axis_3, x_axis_4 ORDER BY y_axis_1 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "source ip", "alias": "x_axis_1", "column": "cef_src", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "destination ip", "alias": "x_axis_2", "column": "cef_dst", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "app", "alias": "x_axis_3", "column": "cef_ftntfgtapp", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "policy name", "alias": "x_axis_4", "column": "cef_ftntfgtpolicyname", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [ { "label": "app #", "alias": "y_axis_1", "column": "cef_ftntfgtapp", "color": "#5960b2", "aggregationFunction": "count", "sortBy": "DESC", "isDerived": false, "havingConditions": [] } ], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "list", "values": [ "critical" ], "column": "cef_ftntfgtapprisk", "operator": null, "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 24, "y": 9, "w": 24, "h": 9, "i": 5, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " }, { "id": "Panel_ID621410", "type": "table", "title": "Audit", "description": "", "config": { "show_legends": true, "legends_position": null, "unit": "numbers", "decimals": 0, "line_thickness": 1.5, "step_value": "0", "top_results_others": false, "axis_border_show": false, "label_option": { "rotate": 0 }, "show_symbol": true, "line_interpolation": "smooth", "legend_width": { "unit": "px" }, "base_map": { "type": "osm" }, "map_type": { "type": "world" }, "map_view": { "zoom": 1, "lat": 0, "lng": 0 }, "map_symbol_style": { "size": "by Value", "size_by_value": { "min": 1, "max": 100 }, "size_fixed": 2 }, "drilldown": [], "mark_line": [], "override_config": [], "connect_nulls": false, "no_value_replacement": "", "wrap_table_cells": false, "table_transpose": false, "table_dynamic_columns": false, "mappings": [ { "type": "value", "value": "5", "color": "#fa0c0c", "text": "" }, { "type": "value", "value": "4", "color": "#f5900c", "text": "" }, { "type": "value", "value": "3", "color": "#b88932", "text": "" }, { "type": "value", "value": "2", "color": "#ebff91", "text": "" }, { "type": "value", "value": "1", "color": "#07f22b", "text": "" } ], "color": { "mode": "palette-classic-by-series", "fixedColor": [ "#53ca53" ], "seriesBy": "last" }, "trellis": { "layout": null, "num_of_columns": 1 } }, "queryType": "sql", "queries": [ { "query": "SELECT cef_src as \"x_axis_1\", cef_dst as \"x_axis_2\", cef_name as \"x_axis_3\", cef_deviceeventclassid as \"x_axis_4\", cef_severity as \"x_axis_5\", cef_externalid as \"x_axis_6\" FROM \"fortinet_fw_syslog\" WHERE cef_severity IS NOT NULL AND cef_src IS NOT NULL ORDER BY x_axis_5 DESC", "vrlFunctionQuery": "", "customQuery": false, "fields": { "stream": "fortinet_fw_syslog", "stream_type": "logs", "x": [ { "label": "Source IP", "alias": "x_axis_1", "column": "cef_src", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Destination IP", "alias": "x_axis_2", "column": "cef_dst", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Name", "alias": "x_axis_3", "column": "cef_name", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Device Event ID", "alias": "x_axis_4", "column": "cef_deviceeventclassid", "color": null, "isDerived": false, "havingConditions": [] }, { "label": "Severity", "alias": "x_axis_5", "column": "cef_severity", "color": null, "sortBy": "DESC", "isDerived": false, "havingConditions": [] }, { "label": "External ID", "alias": "x_axis_6", "column": "cef_externalid", "color": null, "isDerived": false, "havingConditions": [] } ], "y": [], "z": [], "breakdown": [], "filter": { "filterType": "group", "logicalOperator": "AND", "conditions": [ { "type": "condition", "values": [], "column": "cef_severity", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" }, { "type": "condition", "values": [], "column": "cef_src", "operator": "Is Not Null", "value": null, "logicalOperator": "AND", "filterType": "condition" } ] } }, "config": { "promql_legend": "", "layer_type": "scatter", "weight_fixed": 1, "limit": 0, "min": 0, "max": 100, "time_shift": [] } } ], "layout": { "x": 0, "y": 18, "w": 24, "h": 9, "i": 6, "moved": false }, "htmlContent": "", "markdownContent": "", "customChartContent": " // To know more about ECharts , \n// visit: https://echarts.apache.org/examples/en/index.html \n// Example: https://echarts.apache.org/examples/en/editor.html?c=line-simple \n// Define your ECharts 'option' here. \n// 'data' variable is available for use and contains the response data from the search result and it is an array.\noption = { \n \n};\n " } ] } ], "variables": { "list": [], "showDynamicFilters": true }, "defaultDatetimeDuration": { "type": "relative", "relativeTimePeriod": "1d", "startTime": 1746724791164000, "endTime": 1746811191164000 } }