From d4905968f6dd8f834a4dfa7c2b6e2054b09cacf6 Mon Sep 17 00:00:00 2001 From: Bhozar <1184220+bhozar@users.noreply.github.com> Date: Tue, 4 Aug 2020 18:17:14 +0100 Subject: [PATCH] Add files via upload Included demo images. Fix for issue https://github.com/domainaware/parsedmarc/issues/162 --- grafana/Grafana-DMARC_Reports.json | 3337 +++++++++++++++++---------- grafana/grafana-dmarc-reports00.png | Bin 0 -> 139560 bytes grafana/grafana-dmarc-reports01.png | Bin 0 -> 118629 bytes grafana/grafana-dmarc-reports02.png | Bin 0 -> 176073 bytes grafana/grafana-dmarc-reports03.png | Bin 0 -> 318137 bytes grafana/grafana-dmarc-reports04.png | Bin 0 -> 15647 bytes grafana/grafana-dmarc-reports05.png | Bin 0 -> 15543 bytes 7 files changed, 2143 insertions(+), 1194 deletions(-) create mode 100644 grafana/grafana-dmarc-reports00.png create mode 100644 grafana/grafana-dmarc-reports01.png create mode 100644 grafana/grafana-dmarc-reports02.png create mode 100644 grafana/grafana-dmarc-reports03.png create mode 100644 grafana/grafana-dmarc-reports04.png create mode 100644 grafana/grafana-dmarc-reports05.png diff --git a/grafana/Grafana-DMARC_Reports.json b/grafana/Grafana-DMARC_Reports.json index 0a172c9..0c0151d 100644 --- a/grafana/Grafana-DMARC_Reports.json +++ b/grafana/Grafana-DMARC_Reports.json @@ -11,19 +11,19 @@ "type": "grafana", "id": "grafana", "name": "Grafana", - "version": "6.6.1" + "version": "7.1.1" }, { "type": "panel", "id": "grafana-piechart-panel", "name": "Pie Chart", - "version": "1.4.0" + "version": "1.5.0" }, { "type": "panel", "id": "grafana-worldmap-panel", "name": "Worldmap Panel", - "version": "0.2.1" + "version": "0.3.2" }, { "type": "panel", @@ -47,7 +47,7 @@ "type": "panel", "id": "text", "name": "Text", - "version": "" + "version": "7.1.0" } ], "annotations": { @@ -68,7 +68,7 @@ "gnetId": null, "graphTooltip": 0, "id": null, - "iteration": 1581460929581, + "iteration": 1596560916058, "links": [], "panels": [ { @@ -85,16 +85,26 @@ { "content": "# DMARC Summary\r\nAs the name suggests, this dashboard is the best place to start reviewing your aggregate DMARC data.\r\n\r\nAcross the top of the dashboard, three pie charts display the percentage of alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment will filter for that value.\r\n\r\n***Note***\r\nMessages should not be considered malicious just because they failed to pass DMARC; especially if you have just started collecting data. It may be a legitimate service that needs SPF and DKIM configured correctly.\r\n\r\nStart by filtering the results to only show failed DKIM alignment. While DMARC passes if a message passes SPF or DKIM alignment, only DKIM alignment remains valid when a message is forwarded without changing the from address, which is often caused by a mailbox forwarding rule. This is because DKIM signatures are part of the message headers, whereas SPF relies on SMTP session headers.\r\n\r\nUnderneath the pie charts. you can see graphs of DMARC passage and message disposition over time.\r\n\r\nUnder the graphs you will find the most useful data tables on the dashboard. On the left, there is a list of organizations that are sending you DMARC reports. In the center, there is a list of sending servers grouped by the base domain in their reverse DNS. On the right, there is a list of email from domains, sorted by message volume.\r\n\r\nBy hovering your mouse over a data table value and using the magnifying glass icons, you can filter on or filter out different values. Start by looking at the Message Sources by Reverse DNS table. Find a sender that you recognize, such as an email marketing service, hover over it, and click on the plus (+) magnifying glass icon, to add a filter that only shows results for that sender. Now, look at the Message From Header table to the right. That shows you the domains that a sender is sending as, which might tell you which brand/business is using a particular service. With that information, you can contact them and have them set up DKIM.\r\n\r\n***Note***\r\nIf you have a lot of B2C customers, you may see a high volume of emails as your domains coming from consumer email services, such as Google/Gmail and Yahoo! This occurs when customers have mailbox rules in place that forward emails from an old account to a new account, which is why DKIM authentication is so important, as mentioned earlier. Similar patterns may be observed with businesses who send from reverse DNS addressees of parent, subsidiary, and outdated brands.\r\n\r\n***Note***\r\nYou can add your own custom temporary filters by clicking on Add Filter at the upper right of the page.\r\n\r\n# DMARC Forensic Samples\r\nThe DMARC Forensic Samples section contains information on DMARC forensic reports (also known as failure reports or ruf reports). These reports contain samples of emails that have failed to pass DMARC.\r\n\r\n***Note***\r\nMost recipients do not send forensic/failure/ruf reports at all to avoid privacy leaks. Some recipients (notably Chinese webmail services) will only supply the headers of sample emails. Very few provide the entire email.\r\n\r\n# DMARC Alignment Guide\r\nDMARC ensures that SPF and DKIM authentication mechanisms actually authenticate against the same domain that the end user sees.\r\n\r\nA message passes a DMARC check by passing DKIM or SPF, **as long as the related indicators are also in alignment.**\r\n\r\n| \t| DKIM \t| SPF \t|\r\n|-----------\t|--------------------------------------------------------------------------------------------------------------------------------------------------\t|----------------------------------------------------------------------------------------------------------------\t|\r\n| **Passing** \t| The signature in the DKIM header is validated using a public key that is published as a DNS record of the domain name specified in the signature \t| The mail server's IP address is listed in the SPF record of the domain in the SMTP envelope's mail from header \t|\r\n| **Alignment** \t| The signing domain aligns with the domain in the message's from header \t| The domain in the SMTP envelope's mail from header aligns with the domain in the message's from header \t|\r\n\r\n\r\n# Further Reading\r\n[Demystifying DMARC: A guide to preventing email spoofing](https://seanthegeek.net/459/demystifying-dmarc/amp/)\r\n\r\n[DMARC Manual](https://menainfosec.com/wp-content/uploads/2017/12/DMARC_Service_Manual.pdf)\r\n\r\n[What is “External Destination Verification”?](https://dmarcian.com/what-is-external-destination-verification/)", "datasource": null, + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, "gridPos": { - "h": 9, - "w": 24, + "h": 12, + "w": 23, "x": 0, "y": 1 }, "id": 26, "links": [], "mode": "markdown", - "options": {}, + "options": { + "content": "# DMARC Summary\r\nAs the name suggests, this dashboard is the best place to start reviewing your aggregate DMARC data.\r\n\r\nAcross the top of the dashboard, three pie charts display the percentage of alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment will filter for that value.\r\n\r\n***Note***\r\nMessages should not be considered malicious just because they failed to pass DMARC; especially if you have just started collecting data. It may be a legitimate service that needs SPF and DKIM configured correctly.\r\n\r\nStart by filtering the results to only show failed DKIM alignment. While DMARC passes if a message passes SPF or DKIM alignment, only DKIM alignment remains valid when a message is forwarded without changing the from address, which is often caused by a mailbox forwarding rule. This is because DKIM signatures are part of the message headers, whereas SPF relies on SMTP session headers.\r\n\r\nUnderneath the pie charts. you can see graphs of DMARC passage and message disposition over time.\r\n\r\nUnder the graphs you will find the most useful data tables on the dashboard. On the left, there is a list of organizations that are sending you DMARC reports. In the center, there is a list of sending servers grouped by the base domain in their reverse DNS. On the right, there is a list of email from domains, sorted by message volume.\r\n\r\nBy hovering your mouse over a data table value and using the magnifying glass icons, you can filter on or filter out different values. Start by looking at the Message Sources by Reverse DNS table. Find a sender that you recognize, such as an email marketing service, hover over it, and click on the plus (+) magnifying glass icon, to add a filter that only shows results for that sender. Now, look at the Message From Header table to the right. That shows you the domains that a sender is sending as, which might tell you which brand/business is using a particular service. With that information, you can contact them and have them set up DKIM.\r\n\r\n***Note***\r\nIf you have a lot of B2C customers, you may see a high volume of emails as your domains coming from consumer email services, such as Google/Gmail and Yahoo! This occurs when customers have mailbox rules in place that forward emails from an old account to a new account, which is why DKIM authentication is so important, as mentioned earlier. Similar patterns may be observed with businesses who send from reverse DNS addressees of parent, subsidiary, and outdated brands.\r\n\r\n***Note***\r\nYou can add your own custom temporary filters by clicking on Add Filter at the upper right of the page.\r\n\r\n# DMARC Forensic Samples\r\nThe DMARC Forensic Samples section contains information on DMARC forensic reports (also known as failure reports or ruf reports). These reports contain samples of emails that have failed to pass DMARC.\r\n\r\n***Note***\r\nMost recipients do not send forensic/failure/ruf reports at all to avoid privacy leaks. Some recipients (notably Chinese webmail services) will only supply the headers of sample emails. Very few provide the entire email.\r\n\r\n# DMARC Alignment Guide\r\nDMARC ensures that SPF and DKIM authentication mechanisms actually authenticate against the same domain that the end user sees.\r\n\r\nA message passes a DMARC check by passing DKIM or SPF, **as long as the related indicators are also in alignment.**\r\n\r\n| \t| DKIM \t| SPF \t|\r\n|-----------\t|--------------------------------------------------------------------------------------------------------------------------------------------------\t|----------------------------------------------------------------------------------------------------------------\t|\r\n| **Passing** \t| The signature in the DKIM header is validated using a public key that is published as a DNS record of the domain name specified in the signature \t| The mail server's IP address is listed in the SPF record of the domain in the SMTP envelope's mail from header \t|\r\n| **Alignment** \t| The signing domain aligns with the domain in the message's from header \t| The domain in the SMTP envelope's mail from header aligns with the domain in the message's from header \t|\r\n\r\n\r\n# Further Reading\r\n[Demystifying DMARC: A guide to preventing email spoofing](https://seanthegeek.net/459/demystifying-dmarc/amp/)\r\n\r\n[DMARC Manual](https://menainfosec.com/wp-content/uploads/2017/12/DMARC_Service_Manual.pdf)\r\n\r\n[What is “External Destination Verification”?](https://dmarcian.com/what-is-external-destination-verification/)", + "mode": "markdown" + }, + "pluginVersion": "7.1.0", "timeFrom": null, "timeShift": null, "title": "", @@ -131,6 +141,12 @@ "threshold": 0 }, "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, "fontSize": "120%", "format": "none", "gridPos": { @@ -150,7 +166,6 @@ "links": [], "maxDataPoints": 3, "nullPointMode": "connected", - "options": {}, "pieType": "donut", "strokeWidth": "4", "targets": [ @@ -158,6 +173,7 @@ "alias": "", "bucketAggs": [ { + "$$hashKey": "object:243", "fake": true, "field": "spf_aligned", "id": "3", @@ -171,6 +187,7 @@ "type": "terms" }, { + "$$hashKey": "object:244", "field": "date_range", "id": "2", "settings": { @@ -184,6 +201,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:241", "field": "message_count", "id": "1", "meta": {}, @@ -215,6 +233,12 @@ "threshold": 0 }, "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, "fontSize": "120%", "format": "none", "gridPos": { @@ -234,7 +258,6 @@ "links": [], "maxDataPoints": 3, "nullPointMode": "connected", - "options": {}, "pieType": "donut", "strokeWidth": "4", "targets": [ @@ -299,6 +322,12 @@ }, "datasource": "$datasourceag", "description": "", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, "fontSize": "120%", "format": "none", "gridPos": { @@ -319,13 +348,13 @@ "links": [], "maxDataPoints": 3, "nullPointMode": "connected", - "options": {}, "pieType": "donut", "strokeWidth": "4", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:385", "fake": true, "field": "passed_dmarc", "id": "3", @@ -339,6 +368,7 @@ "type": "terms" }, { + "$$hashKey": "object:386", "field": "date_range", "id": "2", "settings": { @@ -352,6 +382,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:383", "field": "message_count", "id": "1", "meta": {}, @@ -390,6 +421,18 @@ "dashes": false, "datasource": "$datasourceag", "decimals": null, + "fieldConfig": { + "defaults": { + "custom": {}, + "links": [ + { + "title": "", + "url": "" + } + ] + }, + "overrides": [] + }, "fill": 2, "fillGradient": 6, "gridPos": { @@ -417,15 +460,8 @@ "linewidth": 2, "links": [], "nullPointMode": "null", - "options": { - "dataLinks": [ - { - "title": "", - "url": "" - } - ] - }, "percentage": false, + "pluginVersion": "7.1.1", "pointradius": 2, "points": false, "renderer": "flot", @@ -453,7 +489,7 @@ "field": "date_range", "id": "2", "settings": { - "interval": "86399s", + "interval": "1d", "min_doc_count": 0, "trimEdges": 0 }, @@ -534,6 +570,13 @@ "dashes": false, "datasource": "$datasourceag", "decimals": null, + "fieldConfig": { + "defaults": { + "custom": {}, + "links": [] + }, + "overrides": [] + }, "fill": 2, "fillGradient": 6, "gridPos": { @@ -561,10 +604,8 @@ "linewidth": 2, "links": [], "nullPointMode": "null", - "options": { - "dataLinks": [] - }, "percentage": false, + "pluginVersion": "7.1.1", "pointradius": 2, "points": false, "renderer": "flot", @@ -592,7 +633,7 @@ "field": "date_range", "id": "2", "settings": { - "interval": "86399s", + "interval": "1d", "min_doc_count": 0, "trimEdges": 0 }, @@ -666,6 +707,13 @@ "dashes": false, "datasource": "$datasourceag", "decimals": null, + "fieldConfig": { + "defaults": { + "custom": {}, + "links": [] + }, + "overrides": [] + }, "fill": 2, "fillGradient": 6, "gridPos": { @@ -693,10 +741,8 @@ "linewidth": 2, "links": [], "nullPointMode": "null", - "options": { - "dataLinks": [] - }, "percentage": false, + "pluginVersion": "7.1.1", "pointradius": 2, "points": false, "renderer": "flot", @@ -724,7 +770,7 @@ "field": "date_range", "id": "2", "settings": { - "interval": "86399s", + "interval": "1d", "min_doc_count": 0, "trimEdges": 0 }, @@ -800,6 +846,13 @@ "dashes": false, "datasource": "$datasourceag", "decimals": null, + "fieldConfig": { + "defaults": { + "custom": {}, + "links": [] + }, + "overrides": [] + }, "fill": 2, "fillGradient": 6, "gridPos": { @@ -827,10 +880,8 @@ "linewidth": 2, "links": [], "nullPointMode": "null", - "options": { - "dataLinks": [] - }, "percentage": false, + "pluginVersion": "7.1.1", "pointradius": 2, "points": false, "renderer": "flot", @@ -858,7 +909,7 @@ "field": "date_range", "id": "2", "settings": { - "interval": "86399s", + "interval": "1d", "min_doc_count": 0, "trimEdges": 0 }, @@ -934,6 +985,13 @@ "dashes": false, "datasource": "$datasourceag", "decimals": null, + "fieldConfig": { + "defaults": { + "custom": {}, + "links": [] + }, + "overrides": [] + }, "fill": 2, "fillGradient": 6, "gridPos": { @@ -961,10 +1019,8 @@ "linewidth": 2, "links": [], "nullPointMode": "null", - "options": { - "dataLinks": [] - }, "percentage": false, + "pluginVersion": "7.1.1", "pointradius": 2, "points": false, "renderer": "flot", @@ -992,7 +1048,7 @@ "field": "date_range", "id": "2", "settings": { - "interval": "86399s", + "interval": "1d", "min_doc_count": 0, "trimEdges": 0 }, @@ -1068,6 +1124,13 @@ "dashLength": 10, "dashes": false, "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": {}, + "links": [] + }, + "overrides": [] + }, "fill": 2, "fillGradient": 6, "gridPos": { @@ -1093,10 +1156,8 @@ "linewidth": 2, "links": [], "nullPointMode": "null", - "options": { - "dataLinks": [] - }, "percentage": false, + "pluginVersion": "7.1.1", "pointradius": 2, "points": false, "renderer": "flot", @@ -1124,7 +1185,7 @@ "field": "date_range", "id": "2", "settings": { - "interval": "86399s", + "interval": "1d", "min_doc_count": 0, "trimEdges": 0 }, @@ -1190,56 +1251,62 @@ { "cacheTimeout": null, "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": {}, + "displayName": "Total Message Count", + "mappings": [ + { + "id": 0, + "op": "=", + "text": "N/A", + "type": 1, + "value": "null" + } + ], + "nullValueMode": "connected", + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "dark-blue", + "value": null + } + ] + }, + "unit": "locale" + }, + "overrides": [] + }, "gridPos": { - "h": 10, - "w": 5, + "h": 4, + "w": 12, "x": 0, "y": 38 }, "id": 36, - "interval": "86399s", + "interval": "$interval", "links": [], "options": { "colorMode": "background", - "fieldOptions": { + "graphMode": "area", + "justifyMode": "auto", + "orientation": "auto", + "reduceOptions": { "calcs": [ "sum" ], - "defaults": { - "mappings": [ - { - "id": 0, - "op": "=", - "text": "N/A", - "type": 1, - "value": "null" - } - ], - "nullValueMode": "connected", - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "blue", - "value": null - } - ] - }, - "title": "Total Email Count", - "unit": "none" - }, - "overrides": [], + "fields": "", "values": false }, - "graphMode": "area", - "justifyMode": "auto", - "orientation": "auto" + "textMode": "value_and_name" }, - "pluginVersion": "6.6.1", + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:430", "fake": true, "field": "date_range", "id": "6", @@ -1254,6 +1321,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:428", "field": "message_count", "id": "4", "meta": {}, @@ -1273,214 +1341,89 @@ "type": "stat" }, { - "columns": [], "datasource": "$datasourceag", - "fontSize": "100%", - "gridPos": { - "h": 10, - "w": 7, - "x": 5, - "y": 38 - }, - "id": 9, - "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": true - }, - "styles": [ - { - "alias": "Reporting Organisation", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "Org Extra Contact Info URL (If available)", - "linkUrl": "${__cell_2:raw}", - "mappingType": 1, - "pattern": "org_name.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Org Extra Contact Info", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "org_extra_contact_info.keyword", - "thresholds": [], - "type": "hidden", - "unit": "short" - } - ], - "targets": [ - { - "bucketAggs": [ + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [ { - "fake": true, - "field": "org_name.keyword", - "id": "6", - "settings": { - "min_doc_count": 1, - "missing": "-", - "order": "desc", - "orderBy": "4", - "size": "0" + "from": "", + "id": 0, + "text": "", + "to": "", + "type": 1 + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null }, - "type": "terms" - } - ], - "hide": false, - "metrics": [ - { - "field": "message_count", - "id": "4", - "meta": {}, - "settings": {}, - "type": "sum" - } - ], - "query": "header_from.keyword:$fromdomain", - "refId": "A", - "timeField": "date_range" + { + "color": "red", + "value": 80 + } + ] + } }, - { - "bucketAggs": [ - { - "fake": true, - "field": "org_extra_contact_info.keyword", - "id": "6", - "settings": { - "min_doc_count": 1, - "missing": null, - "order": "desc", - "orderBy": "4", - "size": "0" + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" }, - "type": "terms" - } - ], - "hide": false, - "metrics": [ - { - "field": "message_count", - "id": "4", - "meta": {}, - "settings": {}, - "type": "sum" - } - ], - "query": "header_from.keyword:$fromdomain", - "refId": "B", - "timeField": "date_range" - } - ], - "timeFrom": null, - "timeShift": null, - "title": "Reporting Organisations", - "transform": "table", - "type": "table" - }, - { - "columns": [], - "datasource": "$datasourceag", - "fontSize": "100%", + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + } + ] + } + ] + }, "gridPos": { - "h": 10, - "w": 6, + "h": 8, + "w": 12, "x": 12, "y": 38 }, "id": 10, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": true + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] }, - "styles": [ - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:920", "fake": true, "field": "source_base_domain.keyword", "id": "6", @@ -1497,6 +1440,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:918", "field": "message_count", "id": "4", "meta": {}, @@ -1512,73 +1456,297 @@ "timeFrom": null, "timeShift": null, "title": "Top 2000 Message Sources by Reverse DNS", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "source_base_domain.keyword": "Reverse DNS Base" + } + } + } + ], "type": "table" }, { - "columns": [], "datasource": "$datasourceag", - "fontSize": "100%", - "gridPos": { - "h": 10, - "w": 6, - "x": 18, - "y": 38 - }, - "id": 11, - "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": true - }, - "styles": [ - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } }, - { - "alias": "Header From", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "header_from.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Reporting Organisation" + }, + "properties": [ + { + "id": "custom.width", + "value": 183 + } + ] + } + ] + }, + "gridPos": { + "h": 11, + "w": 12, + "x": 0, + "y": 42 + }, + "id": 9, + "links": [], + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] + }, + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:291", + "fake": true, + "field": "org_name.keyword", + "id": "7", + "settings": { + "min_doc_count": "1", + "missing": null, + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:98", + "fake": true, + "field": "org_extra_contact_info.keyword", + "id": "6", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + } + ], + "hide": false, + "metrics": [ + { + "$$hashKey": "object:96", + "field": "message_count", + "id": "4", + "meta": {}, + "settings": {}, + "type": "sum" + } + ], + "query": "header_from.keyword:$fromdomain", + "refId": "A", + "timeField": "date_range" + }, + { + "bucketAggs": [ + { + "$$hashKey": "object:102", + "fake": true, + "field": "org_extra_contact_info.keyword", + "id": "6", + "settings": { + "min_doc_count": 1, + "missing": null, + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + } + ], + "hide": true, + "metrics": [ + { + "$$hashKey": "object:100", + "field": "message_count", + "id": "4", + "meta": {}, + "settings": {}, + "type": "sum" + } + ], + "query": "header_from.keyword:$fromdomain", + "refId": "B", + "timeField": "date_range" + } + ], + "timeFrom": null, + "timeShift": null, + "title": "Reporting Organisations", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "org_extra_contact_info.keyword": "Org Contact Info", + "org_name.keyword": "Reporting Organisation" + } + } + } + ], + "type": "table" + }, + { + "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Header From" + }, + "properties": [ + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Open ${__data.fields[\"header_from.keyword\"]} in new window", + "url": "https://${__data.fields[\"header_from.keyword\"]}" + } + ] + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + } + ] + } + ] + }, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 46 + }, + "id": 11, + "links": [], + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] + }, + "pluginVersion": "7.1.1", + "targets": [ + { + "bucketAggs": [ + { + "$$hashKey": "object:388", "fake": true, "field": "header_from.keyword", "id": "6", @@ -1595,6 +1763,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:386", "field": "message_count", "id": "4", "meta": {}, @@ -1610,25 +1779,43 @@ "timeFrom": null, "timeShift": null, "title": "Message Volume by Header From", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "header_from.keyword": "Header From" + } + } + } + ], "type": "table" }, { "circleMaxSize": 30, "circleMinSize": 2, "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" + "#C4162A", + "#FA6400", + "#37872D" ], "datasource": "$datasourceag", "decimals": 0, "esMetric": "Count", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, "gridPos": { "h": 10, "w": 16, "x": 0, - "y": 48 + "y": 53 }, "hideEmpty": true, "hideZero": true, @@ -1641,7 +1828,6 @@ "mapCenterLongitude": 0, "maxDataPoints": 1, "mouseWheelZoom": true, - "options": {}, "showLegend": true, "stickyLabels": true, "tableQueryOptions": { @@ -1655,6 +1841,7 @@ { "bucketAggs": [ { + "$$hashKey": "object:710", "fake": true, "field": "source_country.keyword", "id": "7", @@ -1667,6 +1854,7 @@ "type": "terms" }, { + "$$hashKey": "object:711", "fake": true, "field": "date_range", "id": "6", @@ -1681,6 +1869,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:708", "field": "message_count", "id": "4", "meta": {}, @@ -1693,7 +1882,7 @@ "timeField": "date_range" } ], - "thresholds": "10,500", + "thresholds": "500,10", "timeFrom": null, "timeShift": null, "title": "Map of Message Source Countries", @@ -1704,82 +1893,93 @@ "valueName": "total" }, { - "columns": [], "datasource": "$datasourceag", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Country" + }, + "properties": [ + { + "id": "custom.width", + "value": 70 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + } + ] + } + ] + }, "gridPos": { "h": 10, "w": 8, "x": 16, - "y": 48 + "y": 53 }, "id": 39, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 6, - "desc": true + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] }, - "styles": [ - { - "alias": "Country", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_country.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:524", "fake": true, "field": "source_country.keyword", "id": "6", @@ -1796,6 +1996,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:522", "field": "message_count", "id": "4", "meta": {}, @@ -1811,141 +2012,904 @@ "timeFrom": null, "timeShift": null, "title": "Message Source Countries", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "source_country.keyword": "Country" + } + } + } + ], "type": "table" }, { - "columns": [], "datasource": "$datasourceag", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + }, + { + "id": "custom.align", + "value": "left" + }, + { + "id": "custom.width", + "value": 400 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Date" + }, + "properties": [ + { + "id": "unit", + "value": "dateTimeAsIso" + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Country" + }, + "properties": [ + { + "id": "custom.width", + "value": 66 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Source IP" + }, + "properties": [ + { + "id": "custom.width", + "value": 120 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "SPF" + }, + "properties": [ + { + "id": "custom.width", + "value": 56 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "DKIM" + }, + "properties": [ + { + "id": "custom.width", + "value": 62 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "SPF Auth Result" + }, + "properties": [ + { + "id": "custom.width", + "value": 115 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "DKIM Auth Result" + }, + "properties": [ + { + "id": "custom.width", + "value": 123 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Disposition" + }, + "properties": [ + { + "id": "custom.width", + "value": 106 + } + ] + } + ] + }, "gridPos": { "h": 9, "w": 24, "x": 0, - "y": 58 + "y": 63 }, - "id": 14, + "id": 41, + "interval": "1d", "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 4, - "desc": true + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] }, - "styles": [ - { - "alias": "IP Address", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_ip_address.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Reverse DNS", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_reverse_dns.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Base Domain", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Country", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_country.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:457", + "fake": true, + "field": "source_base_domain.keyword", + "id": "6", + "settings": { + "min_doc_count": 1, + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:458", + "fake": true, + "field": "source_reverse_dns.keyword", + "id": "7", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:459", + "fake": true, + "field": "source_ip_address.keyword", + "id": "8", + "settings": { + "min_doc_count": 1, + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:460", + "fake": true, + "field": "source_country.keyword", + "id": "9", + "settings": { + "min_doc_count": 1, + "missing": null, + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:384", + "fake": true, + "field": "disposition.keyword", + "id": "12", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:391", + "fake": true, + "field": "spf_aligned", + "id": "13", + "settings": { + "min_doc_count": "1", + "missing": "false", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:398", + "fake": true, + "field": "dkim_aligned", + "id": "14", + "settings": { + "min_doc_count": "1", + "missing": "false", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:405", + "fake": true, + "field": "org_name.keyword", + "id": "15", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:412", + "fake": true, + "field": "spf_results.result.keyword", + "id": "16", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:622", + "fake": true, + "field": "header_from.keyword", + "id": "17", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + }, + { + "$$hashKey": "object:461", + "fake": true, + "field": "dkim_results.result.keyword", + "id": "10", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "50" + }, + "type": "terms" + } + ], + "hide": false, + "metrics": [ + { + "$$hashKey": "object:455", + "field": "message_count", + "id": "4", + "meta": {}, + "settings": {}, + "type": "sum" + } + ], + "query": "header_from.keyword:$fromdomain", + "refId": "A", + "timeField": "date_range" + } + ], + "timeFrom": null, + "timeShift": null, + "title": "Overview", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": { + "Sum": 11, + "disposition.keyword": 4, + "dkim_aligned": 6, + "dkim_results.result.keyword": 9, + "header_from.keyword": 10, + "org_name.keyword": 7, + "source_base_domain.keyword": 0, + "source_country.keyword": 3, + "source_ip_address.keyword": 2, + "source_reverse_dns.keyword": 1, + "spf_aligned": 5, + "spf_results.result.keyword": 8 + }, + "renameByName": { + "Sum": "Messages", + "date_range": "Date", + "disposition.keyword": "Disposition", + "dkim_aligned": "DKIM", + "dkim_results.domain.keyword": "DKIM Domain", + "dkim_results.result.keyword": "DKIM Auth Result", + "dkim_results.selector.keyword": "DKIM Selector", + "envelope_from.keyword": "Envelope From", + "header_from.keyword": "Email Domain", + "org_name.keyword": "Reporter", + "source_base_domain.keyword": "Sending Domain", + "source_country.keyword": "Country", + "source_ip_address.keyword": "Source IP", + "source_reverse_dns.keyword": "PTR", + "spf_aligned": "SPF", + "spf_results.result.keyword": "SPF Auth Result" + } + } + } + ], + "type": "table" + }, + { + "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [ + { + "from": "", + "id": 0, + "text": "relaxed", + "to": "", + "type": 1, + "value": "r" + }, + { + "from": "", + "id": 1, + "text": "strict", + "to": "", + "type": 1, + "value": "s" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + }, + { + "id": "custom.align", + "value": "left" + }, + { + "id": "custom.width", + "value": 400 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Percentage" + }, + "properties": [ + { + "id": "unit", + "value": "percent" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "dark-yellow", + "value": null + }, + { + "color": "dark-green", + "value": 100 + } + ] + } + }, + { + "id": "custom.displayMode", + "value": "color-background" + }, + { + "id": "custom.width", + "value": 90 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Subdomain Policy" + }, + "properties": [ + { + "id": "custom.width", + "value": 128 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Policy" + }, + "properties": [ + { + "id": "custom.width", + "value": 90 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Forensic Policy" + }, + "properties": [ + { + "id": "custom.width", + "value": 126 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "SPF Policy" + }, + "properties": [ + { + "id": "custom.width", + "value": 121 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "DKIM Policy" + }, + "properties": [ + { + "id": "custom.width", + "value": 100 + } + ] + } + ] + }, + "gridPos": { + "h": 9, + "w": 24, + "x": 0, + "y": 72 + }, + "id": 43, + "interval": "86399", + "links": [], + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] + }, + "pluginVersion": "7.1.1", + "targets": [ + { + "bucketAggs": [ + { + "$$hashKey": "object:457", + "fake": true, + "field": "published_policy.adkim.keyword", + "id": "6", + "settings": { + "min_doc_count": 1, + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:458", + "fake": true, + "field": "published_policy.aspf.keyword", + "id": "7", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:459", + "fake": true, + "field": "published_policy.domain.keyword", + "id": "8", + "settings": { + "min_doc_count": 1, + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:460", + "fake": true, + "field": "published_policy.fo.keyword", + "id": "9", + "settings": { + "min_doc_count": 1, + "missing": null, + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:384", + "fake": true, + "field": "published_policy.p.keyword", + "id": "12", + "settings": { + "min_doc_count": "1", + "missing": "-", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:391", + "fake": true, + "field": "published_policy.pct", + "id": "13", + "settings": { + "min_doc_count": "1", + "missing": null, + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:398", + "fake": true, + "field": "published_policy.sp.keyword", + "id": "14", + "settings": { + "min_doc_count": "1", + "missing": "false", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + } + ], + "hide": false, + "metrics": [ + { + "$$hashKey": "object:455", + "field": "message_count", + "id": "4", + "meta": {}, + "settings": {}, + "type": "sum" + } + ], + "query": "header_from.keyword:$fromdomain", + "refId": "A", + "timeField": "date_range" + } + ], + "timeFrom": null, + "timeShift": null, + "title": "Published Policies (as reported)", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": { + "date_range": false + }, + "indexByName": { + "Sum": 7, + "published_policy.adkim.keyword": 1, + "published_policy.aspf.keyword": 2, + "published_policy.domain.keyword": 0, + "published_policy.fo.keyword": 3, + "published_policy.p.keyword": 4, + "published_policy.pct": 5, + "published_policy.sp.keyword": 6 + }, + "renameByName": { + "Sum": "Messages", + "date_range": "Date", + "disposition.keyword": "Applied Policy", + "dkim_aligned": "DKIM", + "dkim_results.domain.keyword": "DKIM Domain", + "dkim_results.result.keyword": "DKIM Auth Result", + "dkim_results.selector.keyword": "DKIM Selector", + "envelope_from.keyword": "Envelope From", + "header_from.keyword": "Header From", + "org_name.keyword": "Reporter", + "published_policy.adkim.keyword": "DKIM Policy", + "published_policy.aspf.keyword": "SPF Policy", + "published_policy.domain.keyword": "Domain", + "published_policy.fo.keyword": "Forensic Policy", + "published_policy.p.keyword": "Policy", + "published_policy.pct": "Percentage", + "published_policy.sp.keyword": "Subdomain Policy", + "source_base_domain.keyword": "Reverse DNS Base", + "source_country.keyword": "Country", + "source_ip_address.keyword": "Source IP", + "source_reverse_dns.keyword": "PTR", + "spf_aligned": "SPF", + "spf_results.result.keyword": "SPF Auth Result" + } + } + } + ], + "type": "table" + }, + { + "datasource": "$datasourceag", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "IP Address" + }, + "properties": [ + { + "id": "custom.width", + "value": 140 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Country" + }, + "properties": [ + { + "id": "custom.width", + "value": 80 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.width", + "value": 400 + }, + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + }, + { + "id": "custom.align", + "value": "left" + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Base Domain" + }, + "properties": [ + { + "id": "custom.width", + "value": 300 + }, + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Visit Domain", + "url": "https://${__data.fields[\"source_base_domain.keyword\"]}" + } + ] + } + ] + } + ] + }, + "gridPos": { + "h": 9, + "w": 24, + "x": 0, + "y": 81 + }, + "id": 14, + "interval": "", + "links": [], + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] + }, + "pluginVersion": "7.1.1", + "targets": [ + { + "bucketAggs": [ + { + "$$hashKey": "object:921", "fake": true, "field": "source_ip_address.keyword", "id": "6", @@ -1959,6 +2923,7 @@ "type": "terms" }, { + "$$hashKey": "object:922", "fake": true, "field": "source_reverse_dns.keyword", "id": "7", @@ -1972,6 +2937,7 @@ "type": "terms" }, { + "$$hashKey": "object:923", "fake": true, "field": "source_base_domain.keyword", "id": "8", @@ -1985,6 +2951,7 @@ "type": "terms" }, { + "$$hashKey": "object:924", "fake": true, "field": "source_country.keyword", "id": "9", @@ -2001,6 +2968,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:919", "field": "message_count", "id": "4", "meta": {}, @@ -2016,149 +2984,144 @@ "timeFrom": null, "timeShift": null, "title": "Top 1000 Message Source IP Addresses", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "source_base_domain.keyword": "Base Domain", + "source_country.keyword": "Country", + "source_ip_address.keyword": "IP Address", + "source_reverse_dns.keyword": "Reverse DNS" + } + } + } + ], "type": "table" }, { - "columns": [], "datasource": "$datasourceag", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + }, + { + "id": "custom.align", + "value": "left" + }, + { + "id": "custom.width", + "value": 400 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Reverse DNS Base" + }, + "properties": [ + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Visit Domain", + "url": "https://${__data.fields[\"source_base_domain.keyword\"]}" + } + ] + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Header From" + }, + "properties": [ + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Check ${__data.fields[\"header_from.keyword\"]} SPF record", + "url": "https://dmarcian.com/spf-survey/?domain=${__data.fields[\"header_from.keyword\"]}" + } + ] + } + ] + } + ] + }, "gridPos": { "h": 9, "w": 24, "x": 0, - "y": 67 + "y": 90 }, "id": 16, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 5, - "desc": true + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] }, - "styles": [ - { - "alias": "Header From", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "header_from.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Envelope From", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": false, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "envelope_from.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "SPF Result", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "spf_results.result.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "SPF Aligned", - "align": "auto", - "colorMode": "cell", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "#E02F44", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "spf_aligned", - "thresholds": [ - "0", - "1" - ], - "type": "number", - "unit": "short", - "valueMaps": [] - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:457", "fake": true, "field": "header_from.keyword", "id": "6", @@ -2172,6 +3135,7 @@ "type": "terms" }, { + "$$hashKey": "object:458", "fake": true, "field": "envelope_from.keyword", "id": "7", @@ -2185,6 +3149,7 @@ "type": "terms" }, { + "$$hashKey": "object:459", "fake": true, "field": "spf_results.result.keyword", "id": "8", @@ -2198,6 +3163,7 @@ "type": "terms" }, { + "$$hashKey": "object:460", "fake": true, "field": "spf_aligned", "id": "9", @@ -2211,6 +3177,7 @@ "type": "terms" }, { + "$$hashKey": "object:461", "fake": true, "field": "source_base_domain.keyword", "id": "10", @@ -2227,6 +3194,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:455", "field": "message_count", "id": "4", "meta": {}, @@ -2242,168 +3210,149 @@ "timeFrom": null, "timeShift": null, "title": "SPF Alignment Details", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "envelope_from.keyword": "Envelope From", + "header_from.keyword": "Header From", + "source_base_domain.keyword": "Reverse DNS Base", + "spf_aligned": "SPF Aligned", + "spf_results.result.keyword": "SPF Result" + } + } + } + ], "type": "table" }, { - "columns": [], "datasource": "$datasourceag", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + }, + { + "id": "custom.align", + "value": "left" + }, + { + "id": "custom.width", + "value": 400 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Reverse DNS Base" + }, + "properties": [ + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Visit Domain", + "url": "https://${__data.fields[\"source_base_domain.keyword\"]}" + } + ] + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "DKIM Selector" + }, + "properties": [ + { + "id": "custom.width", + "value": 320 + }, + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Open dmarcian.com DKIM Record Checker", + "url": "https://dmarcian.com/dkim-inspector/?domain=${__data.fields[\"dkim_results.domain.keyword\"]}&selector=${__data.fields[\"dkim_results.selector.keyword\"]}" + } + ] + } + ] + } + ] + }, "gridPos": { "h": 9, "w": 24, "x": 0, - "y": 76 + "y": 99 }, - "id": 15, + "id": 40, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 6, - "desc": true + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] }, - "styles": [ - { - "alias": "Header From", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "header_from.keyword", - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "DKIM Selector", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "dkim_results.selector.keyword", - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "DKIM Domain", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": false, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "dkim_results.domain.keyword", - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "DKIM Result", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "dkim_results.result.keyword", - "thresholds": [ - "" - ], - "type": "string", - "unit": "short", - "valueMaps": [] - }, - { - "alias": "DKIM Aligned", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "#E02F44", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "dkim_aligned", - "thresholds": [ - "" - ], - "type": "string", - "unit": "short", - "valueMaps": [] - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "string", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:457", "fake": true, "field": "header_from.keyword", "id": "6", @@ -2417,11 +3366,12 @@ "type": "terms" }, { + "$$hashKey": "object:458", "fake": true, "field": "dkim_results.selector.keyword", "id": "7", "settings": { - "min_doc_count": 1, + "min_doc_count": "1", "missing": "-", "order": "desc", "orderBy": "4", @@ -2430,6 +3380,7 @@ "type": "terms" }, { + "$$hashKey": "object:459", "fake": true, "field": "dkim_results.domain.keyword", "id": "8", @@ -2443,22 +3394,10 @@ "type": "terms" }, { + "$$hashKey": "object:460", "fake": true, "field": "dkim_results.result.keyword", "id": "9", - "settings": { - "min_doc_count": 1, - "missing": "-", - "order": "desc", - "orderBy": "4", - "size": "0" - }, - "type": "terms" - }, - { - "fake": true, - "field": "dkim_aligned", - "id": "10", "settings": { "min_doc_count": 1, "missing": null, @@ -2469,9 +3408,23 @@ "type": "terms" }, { + "$$hashKey": "object:798", + "fake": true, + "field": "dkim_aligned", + "id": "11", + "settings": { + "min_doc_count": "1", + "order": "desc", + "orderBy": "4", + "size": "0" + }, + "type": "terms" + }, + { + "$$hashKey": "object:461", "fake": true, "field": "source_base_domain.keyword", - "id": "5", + "id": "10", "settings": { "min_doc_count": 1, "missing": "-", @@ -2485,6 +3438,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:455", "field": "message_count", "id": "4", "meta": {}, @@ -2500,7 +3454,27 @@ "timeFrom": null, "timeShift": null, "title": "DKIM Alignment Details", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Sum": "Messages", + "dkim_aligned": "DKIM Aligned", + "dkim_results.domain.keyword": "DKIM Domain", + "dkim_results.result.keyword": "DKIM Result", + "dkim_results.selector.keyword": "DKIM Selector", + "envelope_from.keyword": "Envelope From", + "header_from.keyword": "Header From", + "source_base_domain.keyword": "Reverse DNS Base", + "spf_aligned": "SPF Aligned", + "spf_results.result.keyword": "SPF Result" + } + } + } + ], "type": "table" }, { @@ -2510,7 +3484,7 @@ "h": 1, "w": 24, "x": 0, - "y": 85 + "y": 108 }, "id": 32, "panels": [], @@ -2518,204 +3492,112 @@ "type": "row" }, { - "columns": [], "datasource": "$datasourcefo", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Arrival_Date(UTC)" + }, + "properties": [ + { + "id": "unit", + "value": "dateTimeAsIso" + }, + { + "id": "custom.width", + "value": 147 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "AuthFailure" + }, + "properties": [ + { + "id": "custom.width", + "value": 84 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "DeliveryResult" + }, + "properties": [ + { + "id": "custom.width", + "value": 104 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Count" + }, + "properties": [ + { + "id": "custom.width", + "value": 71 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "ReplyTo" + }, + "properties": [ + { + "id": "custom.width", + "value": 122 + } + ] + } + ] + }, "gridPos": { "h": 9, "w": 24, "x": 0, - "y": 86 + "y": 109 }, "id": 20, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": null, - "desc": false + "options": { + "showHeader": true, + "sortBy": [] }, - "styles": [ - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "ArrivalDate(UTC)", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "arrival_date", - "thresholds": [], - "type": "date", - "unit": "short" - }, - { - "alias": "From", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "sample.headers.from.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "To", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "sample.headers.to.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "ReplyTo", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "sample.headers.reply-to.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Subject", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "sample.subject.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Received", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": false, - "mappingType": 1, - "pattern": "sample.headers.received.keyword", - "preserveFormat": false, - "sanitize": true, - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "AuthFailure", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "auth_failure.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "DeliveryResult", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "delivery_results.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "AuthResults", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "authentication_results.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:340", "fake": true, "field": "arrival_date", "id": "6", @@ -2727,6 +3609,7 @@ "type": "date_histogram" }, { + "$$hashKey": "object:341", "fake": true, "field": "sample.headers.from.keyword", "id": "7", @@ -2740,6 +3623,7 @@ "type": "terms" }, { + "$$hashKey": "object:342", "fake": true, "field": "sample.headers.to.keyword", "id": "8", @@ -2753,6 +3637,7 @@ "type": "terms" }, { + "$$hashKey": "object:343", "fake": true, "field": "sample.headers.reply-to.keyword", "id": "10", @@ -2766,6 +3651,7 @@ "type": "terms" }, { + "$$hashKey": "object:344", "fake": true, "field": "auth_failure.keyword", "id": "11", @@ -2778,6 +3664,7 @@ "type": "terms" }, { + "$$hashKey": "object:345", "fake": true, "field": "sample.subject.keyword", "id": "12", @@ -2790,6 +3677,7 @@ "type": "terms" }, { + "$$hashKey": "object:346", "fake": true, "field": "delivery_results.keyword", "id": "14", @@ -2802,6 +3690,7 @@ "type": "terms" }, { + "$$hashKey": "object:347", "fake": true, "field": "authentication_results.keyword", "id": "15", @@ -2814,6 +3703,7 @@ "type": "terms" }, { + "$$hashKey": "object:348", "fake": true, "field": "sample.headers.received.keyword", "id": "13", @@ -2830,6 +3720,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:338", "field": "message_count", "id": "4", "meta": {}, @@ -2845,25 +3736,51 @@ "timeFrom": null, "timeShift": null, "title": "Forensic Samples", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Count": "Count", + "arrival_date": "Arrival_Date(UTC)", + "auth_failure.keyword": "AuthFailure", + "authentication_results.keyword": "Auth Results", + "delivery_results.keyword": "DeliveryResult", + "sample.headers.from.keyword": "From", + "sample.headers.received.keyword": "Received", + "sample.headers.reply-to.keyword": "ReplyTo", + "sample.headers.to.keyword": "To", + "sample.subject.keyword": "Subject" + } + } + } + ], "type": "table" }, { "circleMaxSize": 30, "circleMinSize": 2, "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" + "#C4162A", + "#FA6400", + "#37872D" ], "datasource": "$datasourcefo", "decimals": 0, "esMetric": "Count", + "fieldConfig": { + "defaults": { + "custom": {} + }, + "overrides": [] + }, "gridPos": { "h": 11, "w": 8, "x": 0, - "y": 95 + "y": 118 }, "hideEmpty": true, "hideZero": true, @@ -2876,7 +3793,6 @@ "mapCenterLongitude": 0, "maxDataPoints": 1, "mouseWheelZoom": true, - "options": {}, "showLegend": true, "stickyLabels": true, "tableQueryOptions": { @@ -2891,6 +3807,7 @@ { "bucketAggs": [ { + "$$hashKey": "object:60", "fake": true, "field": "source_country.keyword", "id": "9", @@ -2903,6 +3820,7 @@ "type": "terms" }, { + "$$hashKey": "object:61", "fake": true, "field": "arrival_date", "id": "7", @@ -2917,6 +3835,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:58", "field": "message_count", "id": "4", "meta": {}, @@ -2939,82 +3858,96 @@ "valueName": "total" }, { - "columns": [], "datasource": "$datasourcefo", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [ + { + "from": "", + "id": 0, + "text": "", + "to": "", + "type": 1 + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Count" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Country" + }, + "properties": [ + { + "id": "custom.width", + "value": 70 + } + ] + } + ] + }, "gridPos": { "h": 11, "w": 5, "x": 8, - "y": 95 + "y": 118 }, "id": 23, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 6, - "desc": true + "options": { + "showHeader": true, + "sortBy": [] }, - "styles": [ - { - "alias": "Country", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_country.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:840", "fake": true, "field": "source_country.keyword", "id": "6", @@ -3031,6 +3964,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:838", "field": "message_count", "id": "4", "meta": {}, @@ -3046,141 +3980,126 @@ "timeFrom": null, "timeShift": null, "title": "DMARC Forensic Sample Source Countries", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "source_country.keyword": "Country" + } + } + } + ], "type": "table" }, { - "columns": [], "datasource": "$datasourcefo", - "fontSize": "100%", + "fieldConfig": { + "defaults": { + "custom": { + "align": null + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + } + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "Country" + }, + "properties": [ + { + "id": "custom.width", + "value": 70 + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Base Domain" + }, + "properties": [ + { + "id": "links", + "value": [ + { + "targetBlank": true, + "title": "Visit https://${__data.fields[\"source_base_domain.keyword\"]}", + "url": "https://${__data.fields[\"source_base_domain.keyword\"]}" + } + ] + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "Messages" + }, + "properties": [ + { + "id": "custom.displayMode", + "value": "gradient-gauge" + }, + { + "id": "thresholds", + "value": { + "mode": "percentage", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "dark-purple", + "value": 101 + } + ] + } + } + ] + } + ] + }, "gridPos": { "h": 11, "w": 11, "x": 13, - "y": 95 + "y": 118 }, "id": 24, "links": [], - "options": {}, - "pageSize": 20, - "scroll": true, - "showHeader": true, - "sort": { - "col": 4, - "desc": true + "options": { + "showHeader": true, + "sortBy": [ + { + "desc": true, + "displayName": "Messages" + } + ] }, - "styles": [ - { - "alias": "IP Address", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_ip_address.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Reverse DNS", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_reverse_dns.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Base Domain", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "link": true, - "linkTargetBlank": true, - "linkTooltip": "https://${__cell:raw}", - "linkUrl": "https://${__cell:raw}", - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Country", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_country.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - }, - { - "alias": "Messages", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": null, - "mappingType": 1, - "pattern": "Sum", - "thresholds": [], - "type": "number", - "unit": "none" - }, - { - "alias": "Reverse DNS Base", - "align": "auto", - "colorMode": null, - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "source_base_domain.keyword", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], + "pluginVersion": "7.1.1", "targets": [ { "bucketAggs": [ { + "$$hashKey": "object:653", "fake": true, "field": "source_ip_address.keyword", "id": "6", @@ -3194,6 +4113,7 @@ "type": "terms" }, { + "$$hashKey": "object:654", "fake": true, "field": "source_reverse_dns.keyword", "id": "7", @@ -3207,6 +4127,7 @@ "type": "terms" }, { + "$$hashKey": "object:655", "fake": true, "field": "source_base_domain.keyword", "id": "8", @@ -3220,6 +4141,7 @@ "type": "terms" }, { + "$$hashKey": "object:656", "fake": true, "field": "source_country.keyword", "id": "9", @@ -3236,6 +4158,7 @@ "hide": false, "metrics": [ { + "$$hashKey": "object:651", "field": "message_count", "id": "4", "meta": {}, @@ -3251,12 +4174,27 @@ "timeFrom": null, "timeShift": null, "title": "Top 1000 Forensic Sample Source IP Addresses", - "transform": "table", + "transformations": [ + { + "id": "organize", + "options": { + "excludeByName": {}, + "indexByName": {}, + "renameByName": { + "Count": "Messages", + "source_base_domain.keyword": "Base Domain", + "source_country.keyword": "Country", + "source_ip_address.keyword": "IP Address", + "source_reverse_dns.keyword": "Reverse DNS" + } + } + } + ], "type": "table" } ], "refresh": false, - "schemaVersion": 22, + "schemaVersion": 26, "style": "dark", "tags": [ "DKIM", @@ -3266,22 +4204,9 @@ ], "templating": { "list": [ - { - "datasource": "$datasourceag", - "filters": [ - { - "condition": "", - "key": "" - } - ], - "hide": 0, - "label": "", - "name": "Filters", - "skipUrlSync": false, - "type": "adhoc" - }, { "current": { + "selected": false, "text": "Elasticsearch-dmarc-ag", "value": "Elasticsearch-dmarc-ag" }, @@ -3299,6 +4224,7 @@ }, { "current": { + "selected": false, "text": "Elasticsearch-dmarc-fo", "value": "Elasticsearch-dmarc-fo" }, @@ -3335,6 +4261,30 @@ "tagsQuery": "", "type": "query", "useTags": false + }, + { + "auto": false, + "auto_count": 30, + "auto_min": "10s", + "current": { + "selected": true, + "text": "1d", + "value": "1d" + }, + "hide": 2, + "label": "Interval", + "name": "interval", + "options": [ + { + "selected": true, + "text": "1d", + "value": "1d" + } + ], + "query": "1d", + "refresh": 2, + "skipUrlSync": false, + "type": "interval" } ] }, @@ -3345,7 +4295,6 @@ "timepicker": { "hidden": false, "refresh_intervals": [ - "5s", "10s", "30s", "1m", @@ -3371,5 +4320,5 @@ "timezone": "", "title": "DMARC Reports", "uid": "SDksirRWz", - "version": 87 + "version": 114 } \ No newline at end of file diff --git a/grafana/grafana-dmarc-reports00.png b/grafana/grafana-dmarc-reports00.png new file mode 100644 index 0000000000000000000000000000000000000000..2669fe7b700da19b911b3fe4ca5e310cee9d2740 GIT binary patch literal 139560 zcmeFYS5%YT7B-3nu~1YL1Oiw==|wsL6)RFyM5K$MC^hs>5QL~Sk=_*qK}zUFN`xpK zf}n(&5FoSwfrJnsAvrI8-`?YleRVF*82`<$7eaj3TJxRrS#v(~Su1ZJ7~J7HDtMHQ zjg9Nx-J6ft*x2E0YzNg39|ArREpA%_{@LgG=*|tcvVPDa@XJAm>-yK(*ec?VF>Kg@ z-;Y4=ntHOa2?L{q;rrqU>vn8xto(a7uRr#)THf_f1^r1Q(F1%NS0-H=!6yAWeO0;= zTyO53l{m%-rR!SQjoT}(^MKHoHbk`BzI%jq%Qslm?i_qRVtryhmT zYN-N5{uttsQLyN1)IY;t6voH@dKV^@(XynFfxUAHUHS*}sORw_#cBOdfnBBht{*Zz z`F}>-DF36^%^nlerjXl`1(BazG&ql$F4pg{1!fCT`rqjyo)v#QZZXOTZunU7+tYD3xWVpg zJJFCpe>JZS%xbY1c=})ksrHM; zD{WN6vbuyzF)MIv+O$O?e(tC(eoi2?3%Pk^1(DlwafWk&Lu6yeuf#;?nSUI_Mc}GU zCpZCX4`S9}S<>P;0YU6>lDjp(6^wTnWb3$i0>&-AhyU@;)&youW@xr$__=96nATJQ z-D*1~`*q8|08v0Fetd}p*)(+`WYAXL3-d%PMxtnp9p3GQnNXBlm#nCzY?OMBCiAPEaH2`pAywmB^jgUf2^d+%q?H4ftYQ^#S4Kc0#GoU$ zl>EaD8-GD`PLz&+xIOeLr#t!9C1!gn-PU@IG@HZfz-gMcQvL~#T>QV`Gx8XwR(fKx zJhm$$amFvYd#~#!{;J|UU+B<|v7q>G$dsc)e z0T(acPhq)E1o^LB!@K9V;Y-OqJmk1-YVe>w<)f zvlF!)FEj8tgc=7VNsAdTD*9f#;rhA;Il-8)9~-2~pwEM0#B8d|B zH1E%1{^W!NHEh%V2|Zt`-Zd3dhpd{%%sLh$r^6!X*U_07F{f|W^Kk1P+gXja^Ew)K z^Hc|+5bLxe=^>D5tv`G@V9H=L2o+Pgm`%JP^} zL#Ur_PxZ5!i7H~q_8gb_Y&M(>Gn({mbRM*u@Q7RX3W3E%{_#a54LJx|p`JMs9VW(V zi0xrhx-V0m1EhKPFgi_hFLTCv$5{kVZ?Zi^8B~ zBsEBX;3H-#Os@!9Ka&wS+u3o4P=jll(VPp_R7Gyd6ZWI4U?0)+o12p+hl6BOau^8| znikYba-@frc!$7cnOxT*>ktTAP2hpUf~|j%JbE1c*K}1m|2io>^pN?113Ip6j8_o+ z)rS%2POY5uEEb_5~T=q4*4&1%zrHL7ES1Aw-l?x(e6*MQxV6pU?>ob9)) z>-nijpC~W)9TunzAa1T-t4(y9yi#l+L;1FiFftQU0b$S2Z)CqGmS(ate6782xC$5! zP^)kCuV!4BpR7i4y+Nm1&QZzMU#g|D5e~B8@iS~GdCk$1!NLD^(=VvsE7p9%QTX`z z$;$QZynYe`{Ccv3H6*f4AY~!oIVnml^Ru&&QGRzqwkt!FntfUvDzvmkFCy2Q6%WL@ zCmz!bM~a~zeS$9??wnzeXt zR~5P7>kivprz7UsQxsM7+HYqBUO%ws>Cj}Qv{0EXY6O5I9u~pcg2P(-=?47~er-l_ zuFDN0OeAZy3?lNw+I6#utbis9_YRqc`LDd0EOcU(+aMM-pXeX7xR-2~Ddg+R3cDej z{*`ucaklL5v0PEQNLMCtBl(JU;w>g=((_N)cM?ZF>{)hZ2G1Kq;VbI_d!gV%V+0iK z1rJPlc)fY6YmM7Wxm&@HFM)iVgRoo{&8;pnAZC$s&_XChbI7kXW7YxYF5)?LZge3s zFA|f@dfznHW_GgfCq*ni!i-BY|=A@;}W!~&oF>I4q?(D*z$a7KsjL2T4 z=)6oLF;G9p$Q>(eI?J@KWT#@&LQ4V`bVWPpXO&w+PhQ*=&iHt9v3VtJO$j$mdLcy> z{r(Ix_&4uGYZ=3O8#lcB49XPbp6syf4w+Haz-pbPZ?2}0$^;T;(3(bkF8$OE=1`S+ zFp08EY9?qg4Ff%Uwx?*DjdApaaByY*?6-e1K_M4c?I8~MWVvIdbq;Hr0%;|+hI2%P zAfHEQgN8}ec{f*e113UPyo*JBCIgkC?&P;59}~QH!s{FBh z$j$RAlEKeBdk8D?8m0x%dh zLv@0h^Wkf49^mFN3by7;O$%-v+tomWJ+=y*658&V6{-8V@>7!;;z>eoxks=CNQI)| zsFv^b-|Nd{x+D5o8%CxC|K+wjp0Czh8arVB)bIy92}c%`an-k6zrC!YQ^StQl&FH3 z>v1_B{3)>l^lkGxkR%K3CJXf!wO+(Lx(?Z%&z4G=sMYaV89V1&hP;uSgS^Stn=M%t zS)n`pyiGtVau)mN}f=gzYHY zZm9Us5g^4Mnbe7FiIWHQ*L868S6ZnrY^(jn`8CL?uu|PqVb5wH9Xc)0t-5XKNbzxQ zB1XrzH;IMeiS6>2VkxZ!uWjci9uw>lIHUSRW<*`fU^NskuhvhBZTK!chi4L#yI;U$ zdL=FDw;s!FPJP7{H`{{~*n1s(`G5Kd|PFdEm#8 zqC)d3+Ke0LW|dkt(8!h0Bd-Izu87 zg@lDHyMec6CLWw%ey>@p)6I|r^|MMX7BX_~l5#>MQnp0$$Vkb9iwWFt$e?>`9yy(x z@~LODRf9ZsUpp!ANgs{6`43JDQ*`%#3uCR3Siz&vt=uS?WDZe3XtWB5IT?I`%nH%% zliL2Xp`u?Pc=hY6)}U)aI4+M(5Cw9`@aeg_)saiI61C>sXHWHCrnQHS@KTz+Is#J; zamB=TN4K6xldszH&DV2F<3ving8Jps9+pB?alExJdhrz<^MU*3#S1j(9O|5HThJ2) zn0~7Aa8Aa-b~$DC>e^`Q`HtEJD7&r_z&$fV#g2u#YZYo>~(Y$C(0dj z5x4Mb6ee_Q*xXf!Ze{8H=g%tUzD&boW;x^AtNP) z8N5dHN?CkO!F0uBxPHh0wIeX4?;}t%cxVGAYp_z)+E9(~SY^wyu8dKBa)&hq5Y3%H z;q>RZNQhaBu0BKSDhPXpHnD6CPvC@8n*G5xh{g4Ybq`prdoyFXoYHuJr)%P5obWLp z9C@Q(m||N7FP`7d-;cI9EW7~Dv zf4g$6SJ4h{LHhhE9I`JsAHwac+EWZ}JJz};nuB|+IVb@oS-ybLVYRfOiREqcDn@&`IX&3l=yYlWCl zND5+hVWQb9bgE>N&07czWbcf3T3x2e9Cbg=usXXbPMF?uoSP?03Nt}0fsea+p?cjT zNN&l2B4d|SvLW2?4l6{M-4!Z`L=!y8fx^871um~&vXXW);N`hQ>`nj$J1L3C4y{Z?Ui>fU1A&HgcmglT?vO_iy1S zbNKL0{>yA2vV|I~Hcs~x^;Fdy4jgH;$nYf1boTh(&7oCf6%$(F!*RP({M`J8S5q?T zU6*(VjX~Tw+q*&aL2%faw=wAX@m5OJkyHDhhuQq~o}93tGZ#tqwg?r0rIGu@u9&G#JP{mFwAMZb_2jEmf=+ z{23c5U0aMBs>>nTItES8OD%%*iaO9qQEq(^s5u-z%z6)uzRqbLGaxrL6_wrygWMCDd)q%49OnwOiu*@{WOQYwn3dCrSKI755V)T+oBmA$^k;)_m?xDaZ)3<_T>!!RVPD%4Bmxj<7qk->);EL36!UYqhXx-I?hw+njLhV{@D&KQ|h7*J=n! z-4yZl_s}u#O$pqbOYtPpJXh!o6mq1-p$gygt=(R|StK6RKP{tJmyommhSC{skw;*{cyB$%lYKS);+Tbu}qy4L9Jz3s2<7VkVz5reQi-ys~>1Pbh}aCO5# z=0#KJSPFGEpE#TC1{7G21`Gw3HK@Rj!c%lL`ziDrs?H%6tHj^K=q*f?td$KA4z>AZ zPl=F!slU9`G1*4rRoFB5^4euyZo2UHm%7=MxU!U6k;gHoxZ@(~A^0MEMFh4H*@Eb` zeF0EbK?^3c%Yp}|fG@A3t=&d@_(+XO7&7LB)pB2zGn;whx&(5ZgWzIawN8#78 zK>vOL())NsG&4S!4atabe zXO`AsJy3YohA1oHKFnwRXG-+0l_@W`tf^!j4%(7=RpIi1@CIy_nxgFs=-tRU>G_vW2qJRIvf+jtnxO^-}xP2^PGC$p8M>*>DTxBUV?3zbH1NPHO%$|ibH|@y{GqD=2 zT!CmchqT^wC38M0)lrpuSxjqK0aAm-piIh{=0N`Kk`+j(C}@5Ef5a)q)sb|0NP*B3 z{Y~P+LgqUWlNAIZto@x8o#%JDfGi+gqnD(GrCUzRH=DD-d@r_Vbreykv43O7wC3dT&v60GKBnzMyA z6ESoQF3HlEu|D!&-OUHk-9j#b%4YwS(qR8p!#V+8H}^>Wg)=C*NK*(ChuJ{kyUzbt zD;qsMVEpcEt-@_%B?anh>h#JmSUVTT0m?4M_QDq*;DoYy98V4@&6e8fAYtj-VtX13J#&rtR2tnx zdmFTY_4G)h?0#s>PS`cXN#1`a!ojw=XH(;GZu1viedw-ND1%m(dp}-BwrjHIwg(c; zQ5%74(DF0kUdCR`Tc!ARGN(w!%-M5WbrwB2?^USsZp+E+*c^Hro+g480X858D4(mqQuJefJcYhRtMGg-SG z{j5nGzhfnh5D_zjh_AY5)rkqPb4q%oWOf$RvO>t~S6EIO4~nZW4jHu`wb>F5l>;FC z;Parmp3|2cH?lUyeHV>GgAteM-43Rrq8~_78_XaEwVgHh(4Ss2>9ISp-Vt3kc8QL2 zUn*fhxJAb#HDvqdJ@?&0%xhs2=1rraBg)%6KTbFt7;EqkcOGRXf(8;|QL$`7C{FrtJ{R zV`K?d;}6T8TrtgKZ?hqJE(7R!EsU27J)bmevs1;h**%#(FcSEyxlq|`J+WzJ_)$*h zxMA6v=9dSU=8JVN?dKSMBnIO>$X&$uN72KHD6%A(e~||%5$A#vt8;mEw3&x|Q><4PxqKO@@Ehd|ONOX>EO`U9#v|$`83x&`YH|Haw zDWXj(Rv#R!(AMX6)+|RoF@qHZA6P-Aok*Y|+YMlQT{Ddobb4i!vUu;t>i(cl3mCH( zMHJY|EpkZNW~a86@8C2K9LGd8zDh_v(GZBBSj^7{R6hD_z=^9NET4E`?A%-s0HcN9t#j{f5Ee&krWad2B)064z3J$z$we}n8hAcr@ zMRUxlA!3{PLf8HUVsB|qtU9&R&u!w|msK@#1%;xmisX5Xa*dnju}T8dGsh&455{7= zBXUaLi~3v5D3@ZYJKVLxJzPS%EDKbSS>|GhX$PB z+D*$EtTzW1ThyK%*lk)kpm@H=wU4URm33850n}oteRHQZJ!AYmi~Pa)3PXlfr-xsA zPuHBEou-Q0_Ux3Bvw}#3b?AuyvPPgCeJ9CdJgR}qmE{vW$sh(zWy(3@&N|g;2o-A$ zZ%WK|nT4v{SwEQWQ%V=DoA&>WP#+wX2acJT_NI8Cn16wM=^j z-CB#1Z9qI!t#~Qgzsu+o&*}ank?&aRp=8zot$%R;oA=0}(QFd?O!0gsZz0$~*k^P_ zmatSF++fwzfN^(J_;Sdyaa8TZud!~^NR=Gy+;1}t+c>Sda?m!?bCx<;>9c)kyPw#9 zB!(ODsm}Qu9@=8ibe^TLvK#c%V!NH}LJkA)(PY+Eovn@btv{&Ujnm*Yk=q$8I}`(rR{Vp5WD1 zT(Q*_$p@>{@2pYB=F5^humge%AD6wBF8H1)kK^fz8Oe2TYWL54+f3fF$#K3QdlrN@ICE)^uC~vMS7vL}^23L<<=t&6(xW;3t^- ztFz);t)57p?Dt9P`2EM#fzsA}bXc}5$TA6G?oo65dIWxL$l!XJHX1!%J{2F{56Mh8 zIRE)sla?SXCi946^|jsE-Ns`rS&ijdA>^6Tx7`?Ct9u58OPHRK$*%#pL)L zf~Kh8?%#%`@I-kMmFqd#+9H9R5U)#=`(j{996r5$+{;Ghn$}w96KnlEfW}?!#~5x$ zQLvv{JiHCQYZ$B$?46i`FN4x_6&XWKnqTlI3Bi`A85 zk<{nkC?kq<>c}4UiH7$yP62A;FobmK?hOBqP-n46hwz+JVk49hlP0iLk6Chxs0_vAF zjGwsIwKb!OmQ+8dm<8Q;_yWKP?AVF?c1so0L9ETHM)C|7-Azf#IO>$EFXPv{iIsP* zD}>^>c59T?FLx5v6gx%r20y>DdhZLRBjV9obV9lnC1eS1|D zdv3WOJ!PfGV}E}eTMy9*Bm|zB4_uE$T7^VU1-VVGf0Nn@@aNqG$waG_BzK1~29E1$ zgawG#c@l`9KH1T_k7XO=V$X@+R#{Cx5P|;=n$a=Xg4^_U{js(qwlcnnz_?MmPv=)t z;=1FJszQi)hxb!``l4rYx^;fpt-j}Ca-A2)9s2>~Y1XsfU*^}I_~T{!S=O){ zG9Ws%NYVB;O%+YqvmL0SAEk6+YG(1_tI~e0@^H)&iJ#PuE1M6>k!9S+oNqAS&x2e& zwPv7CYr8#9YuUL>V}u=X`UgqWCAG|AcAjpCWRsFviw?lRLKT2nPo>=yF7SS*k-UZv zZ*cdTJon_l=%bL%h-ov&pr&WANu$FFS?c0Bo`guNGdu~F2_R2Dix%ItK-n&;Yx#01 z+yfjj`Q6_SKT>Y(dO4dXZ*oUh>qA$ir*L>$x4q;FYNK*gwg2u}u zK?CF}Xa4pN<1hEXBcP8kdZ@ab`C2ncXb3HA;^*(0nTSHHc)0a&hOAAH4v5>Tul6P@ zNm5|PuB8Gj^RlEhqTbiRvckAFCH>O4QJ|FjJ7}G2KtT973iCMXl%qnOLsW~EjlwDG z;Kab@%%gv|AH8wgssrMwt?6>cv;HU^N?)2-#x+pghYRhdGHw@%%M?8Db=DCD2uz^;$B+wk zpNus?GD~8lv?CgOsZ3Pkm3uOpD>*AiO(S6fxBs~PUQX-ANJi}3cL)!m5Z2Rjjop7C ze{ZMpVY1)O=)Oiph)6X+G22)Z(bHDwhxcOak9vd8mBDjT5`SIzjk|~TqmQGRnJ#9n=G3*odwZ$C*D7guOyIkJ6E>a?FWW$1zLszw(zOkeS*qi*nT0L4&4)#sTMA6xlhU`stvWm=80TDRU?;QYb9 zQ8uf|_t{=(0{N@3;@)uhYgB4(gU9Y_IK=XIGYZTW8UyUW*QhsAjkHVtRZu#fgVfE0 zo5a#U`$7)^?QN)8h6S)3C);6w0t4r&?RzaR(5M_>yYXu8(#OYjVElI(z}V0Se|y`% zOO+o3x~8+Ifd2xn+yJzjZ5b%h|96W2|9o+B391S-%U<6s9~DLa;Jxy;{X_rt%T`_w z9Ql4dy)nIB{drJezS;W>PLb{PX}sLCI=zCSqOQshdIgvG40SK2%Y|rV>{Ak8OT4Yh zIdUcISCEwC+nepBKdZClgOxMbsZR+vPIEgb2!GJapFFO5(gl0G{!zfAe9_mRDfnTU ztC=|4alY56P<;>n1?qH=BK&(&uGoQ4cifL8M z(~B4QHOiuG?OZ-vx;hizyVZJk2fJ93@0!;I;np9U8~$>75T|6-6MfDeak_N`C^sEv*zLPH&+IY)}0}eqd2CIq4s!h{QcJTQ3&+OK?$4u&APmS*8i<`Uj69%i}>-3D9c)p2&NEm_eH z#0wgn-tBw40KbO$6e|xgL$f(L`^0ftOv>swi7P{0>%3B}AnH%F#o^k_n_3==U7e2p zbIm$H1N?A%p?QAxD~EMboYkoO=GF=#=saDtcNg}ekJn=g%4{GlCpGd1T4Bz=MqOL6 z%T&JsUwijc+$5^^%nQ%JeK_bSuBWb!nZ=mN%ZZ1Dge>vT-9N&#G}2eH{B3(JAy2GW z4FHPIhJp0T5sg1`TZwmdWuk2DoXp`tjiu&R>Cf3L4A$Jzmx>m1MKUtQxZq01`(vV> zJN|fdm9xc#%0G)?t*Ny0Mw%UwfxkqR);9QZb*kxCyWy=34h2=k^zqYJw*4nTkmu1>*tN95z_u_ z-FY#om?KqZ7W?@)oie8 z>*(G27I=TUiYMra7M9``Eq;jlq&hm1s|st6(^}wOo(#$Le4bL`d?%N;6M&fE;XW7k zXJ6F~hzV)FT;0n@d%t}$`KI27Py`!kp71BBnP#vW`T#F2dUhNyD>u>A6iJ})2b+qt ztb3B%d2^J9?^5|JZX3lsb^~m+{KwW*^}3X`i(*?V?|u-L@0z)~5EFB1se-7nfMYUw zMOt6$$}y1PNL0e&rJ%Vk>-a`Yu+=81j08QAbW{fMQpfpX)(MZP53XGz8AUIqTwM}g z2j;)#J^8U_;ce&jQMD2lPv)BvcLP;!js#U)C@cMgEZmlO(a4LQuCJOVl?Nd@GCx zcKz&wgeyz(&n#>{;B;jM>h4Tep8t?Us`l<_tqp-(8^7C1Q2KK-=2Uw?ZzZ&zY}J;B zvQ9BaFvB$7W)^ML-Gh$m3*|_A4XiScW%0H)BzYHO(m-i)>@QAB&Q|CI2<2`*K9c#S zS~h8gjzv%AZl&mu=K>>m01ST6;9T1yteiXemf&>;Ax_$_A&|y57UMeU`2ZPZw3&)YB$Z#?=YN#}3#araUs1&YHi@7pXcA%GQ&$ z$?Do^tlKROdfxT^MAG3Fj-f*id8Qfkd|Ff4yLRhe=6Y1!LSPyc&?EEy|3Y>Lfw0xRmN6L%I_-?BnM(U`JA9bDM+8y+c^lVF&fmIeNCMg~g zVG{z_f4*Iny4OuR@Ohc18+QInBJ{u`83%DuMROIxN&=zwfUuZY@Tpt`rJr*I;dwz| zbaL2*)7phUNVXuL!>9B~oYF4G-d>UsJw;b=dD{1U z(y@553x++(&CHi>h^58h<0U_R1~`1Zl%2#`