mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-11-10 03:07:10 +00:00
768bf75480
* feat: add grafana loki output Push aggregate, failure and SMTP TLS reports as JSON log lines to the Loki push API. Static labels and labels taken from report fields are configurable, host defaults to the FQDN. The timestamp is either the ingest time or the report begin time. Supports basic auth, bearer tokens, X-Scope-OrgID and batching. Push errors are reported as output errors so messages are not archived. Signed-off-by: Sebastian Schubert <basti@schubert.digital> * feat(dashboards): add grafana dashboard for the loki output Signed-off-by: Sebastian Schubert <basti@schubert.digital> * Address Copilot review on the Loki output Responds to Copilot's review of #926: - Treat any push status other than 200/204 as a failure. Loki returns block_ingestion_status_code (260 by default) when block_ingestion_until blocks ingestion, and the logs are discarded (Loki configuration reference); the old >= 300 check counted that as a successful save, so the CLI could archive mailbox messages whose reports were never stored. - Read aggregate begin_date as UTC for timestamp = report_begin. Aggregate CSV rows carry the record's interval_begin, which the parser builds as naive UTC wall-clock time (to_utc=True); reading it as local time shifted entries by the host's UTC offset (+4h on America/New_York). - Group the Published Policies dashboard dedup by org_name as well as report_id: report IDs are only unique per reporter (the PostgreSQL key is UNIQUE (org_name, report_id, ...)). - Drop the legend sum from SMTP TLS Sessions Over Time: its [1d] lookback with the automatic step yields overlapping rolling totals, so the sum counted the same sessions repeatedly. Adds regression tests for each, including a non-UTC timezone test against a real sample report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Address second Copilot review on the Loki output Responds to Copilot's second review of #926 (previously-missed findings): - Strip each [loki] label_fields entry. _str_to_list() only lstrips, so "report_type , domain" produced "report_type " and LokiClient refused to start with "Invalid Loki label name 'report_type '". - Wipe Loki on RESEED=1 even when Elasticsearch is empty. The wipe sat inside the ES-has-docs guard, so after the ES container was recreated a reseed appended a second copy of the samples to Loki, which does not deduplicate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Address third Copilot review on the Loki output Responds to Copilot's third review of #926 (previously-missed findings): - Keep a base URL's query string when appending the push path. The path was string-concatenated, so https://gw.example.org?route=logs became ...?route=logs/loki/api/v1/push, hitting the root path with a corrupted query. The path is now set on the parsed httpx.URL. - Push each report's entries in timestamp order. With timestamp = report_begin, a normalized multi-day aggregate report yields rows source-major (every day of one source, then day 1 of the next), all in one stream. Loki rejects entries older than the newest line minus half of max_chunk_age (1h by default) with too_far_behind (Loki configuration docs, "Accept out-of-order writes"), so later sources were partly rejected. The whole entry list is now sorted before batching. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(loki): do not follow redirects and drop forensic alias httpx re-sends a 301/302 POST as GET, so a redirected push could return 200 without storing anything, and the mailbox messages were archived. Redirects are no longer followed, so a 3xx raises LokiError. Remove save_forensic_report_to_loki: the module is new, so no caller needs the legacy alias. Signed-off-by: Sebastian Schubert <basti@schubert.digital> * fix(dashboards): use the existing Loki datasource uid in the dev bootstrap When a datasource named Loki already exists with another uid, the dashboard import still bound every panel to dmarc-loki. Read the uid from the lookup response instead. Signed-off-by: Sebastian Schubert <basti@schubert.digital> --------- Signed-off-by: Sebastian Schubert <basti@schubert.digital> Co-authored-by: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
3967 lines
95 KiB
JSON
3967 lines
95 KiB
JSON
{
|
|
"__inputs": [
|
|
{
|
|
"name": "DS_LOKI",
|
|
"label": "Loki",
|
|
"description": "Loki datasource for parsedmarc",
|
|
"type": "datasource",
|
|
"pluginId": "loki",
|
|
"pluginName": "Loki"
|
|
}
|
|
],
|
|
"__requires": [
|
|
{
|
|
"type": "datasource",
|
|
"id": "loki",
|
|
"name": "Loki",
|
|
"version": "1.0.0"
|
|
},
|
|
{
|
|
"type": "grafana",
|
|
"id": "grafana",
|
|
"name": "Grafana",
|
|
"version": "10.0.0"
|
|
},
|
|
{
|
|
"type": "panel",
|
|
"id": "piechart",
|
|
"name": "Pie chart",
|
|
"version": ""
|
|
},
|
|
{
|
|
"type": "panel",
|
|
"id": "timeseries",
|
|
"name": "Time series",
|
|
"version": ""
|
|
},
|
|
{
|
|
"type": "panel",
|
|
"id": "stat",
|
|
"name": "Stat",
|
|
"version": ""
|
|
},
|
|
{
|
|
"type": "panel",
|
|
"id": "table",
|
|
"name": "Table",
|
|
"version": ""
|
|
},
|
|
{
|
|
"type": "panel",
|
|
"id": "geomap",
|
|
"name": "Geomap",
|
|
"version": ""
|
|
},
|
|
{
|
|
"type": "panel",
|
|
"id": "text",
|
|
"name": "Text",
|
|
"version": ""
|
|
}
|
|
],
|
|
"annotations": {
|
|
"list": [
|
|
{
|
|
"builtIn": 1,
|
|
"datasource": {
|
|
"type": "grafana",
|
|
"uid": "-- Grafana --"
|
|
},
|
|
"enable": true,
|
|
"hide": true,
|
|
"iconColor": "rgba(0, 211, 255, 1)",
|
|
"name": "Annotations & Alerts",
|
|
"type": "dashboard"
|
|
}
|
|
]
|
|
},
|
|
"description": "Dashboard for reviewing DMARC reports stored in Loki via parsedmarc",
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 0,
|
|
"id": null,
|
|
"links": [],
|
|
"panels": [
|
|
{
|
|
"collapsed": true,
|
|
"gridPos": {
|
|
"h": 1,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 0
|
|
},
|
|
"id": 100,
|
|
"panels": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"gridPos": {
|
|
"h": 4,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 1
|
|
},
|
|
"id": 101,
|
|
"options": {
|
|
"content": "# DMARC Reports — Loki\n\nThis dashboard visualises DMARC aggregate, failure and SMTP TLS reports that\n**parsedmarc** sends to Grafana Loki with the `[loki]` output.\n\nUse the **Domain** dropdown above to filter aggregate reports by the domain the\nreport was published for.\n\nThe time picker selects by log line time. That is when parsedmarc saved a report,\nunless the `[loki]` section sets `timestamp = report_begin`, which places reports at\nthe start of the reported period instead.\n\nSMTP TLS failure details carry no policy domain, so that table lists the report ID.",
|
|
"mode": "markdown"
|
|
},
|
|
"title": "Info",
|
|
"transparent": true,
|
|
"type": "text"
|
|
}
|
|
],
|
|
"title": "Info",
|
|
"type": "row"
|
|
},
|
|
{
|
|
"collapsed": false,
|
|
"gridPos": {
|
|
"h": 1,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 1
|
|
},
|
|
"id": 102,
|
|
"panels": [],
|
|
"title": "DMARC Aggregate — Summary",
|
|
"type": "row"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "true"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#37872D",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "false"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#E0B400",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 8,
|
|
"x": 0,
|
|
"y": 2
|
|
},
|
|
"id": 1,
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"pieType": "donut",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "single"
|
|
}
|
|
},
|
|
"title": "SPF Alignment",
|
|
"transparent": true,
|
|
"type": "piechart",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (spf_aligned) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json spf_aligned, count | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"spf_aligned": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"spf_aligned": "spf_aligned",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "true"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#37872D",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "false"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#E0B400",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 8,
|
|
"x": 8,
|
|
"y": 2
|
|
},
|
|
"id": 2,
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"pieType": "donut",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "single"
|
|
}
|
|
},
|
|
"title": "DKIM Alignment",
|
|
"transparent": true,
|
|
"type": "piechart",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (dkim_aligned) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json dkim_aligned, count | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"dkim_aligned": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"dkim_aligned": "dkim_aligned",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "none"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#E0B400",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "quarantine"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#FF9830",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "reject"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#F2495C",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 8,
|
|
"x": 16,
|
|
"y": 2
|
|
},
|
|
"id": 3,
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"pieType": "donut",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "single"
|
|
}
|
|
},
|
|
"title": "DMARC Disposition",
|
|
"transparent": true,
|
|
"type": "piechart",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (disposition) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json disposition, count | label_format disposition=`{{ or .disposition \"unknown\" }}` | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"disposition": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"disposition": "disposition",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "Messages",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"gradientMode": "scheme",
|
|
"lineInterpolation": "smooth",
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "none"
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "pass"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-green",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "fail"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-red",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "softfail"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "super-light-green",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "neutral"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "super-light-blue",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "temperror"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "semi-dark-yellow",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "permerror"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-orange",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 11
|
|
},
|
|
"id": 4,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"title": "SPF Results Over Time",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (spf_results) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json spf_results, count | label_format spf_results=`{{ or .spf_results \"none\" }}` | __error__=\"\" | unwrap count [1d]))",
|
|
"legendFormat": "{{spf_results}}",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "Messages",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"gradientMode": "scheme",
|
|
"lineInterpolation": "smooth",
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "none"
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "pass"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-green",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "fail"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-red",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 11
|
|
},
|
|
"id": 5,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"title": "DKIM Results Over Time",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (dkim_results) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json dkim_results, count | label_format dkim_results=`{{ or .dkim_results \"none\" }}` | __error__=\"\" | unwrap count [1d]))",
|
|
"legendFormat": "{{dkim_results}}",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "Messages",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"gradientMode": "scheme",
|
|
"lineInterpolation": "smooth",
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "none"
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "true"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-green",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "false"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-red",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 20
|
|
},
|
|
"id": 6,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"title": "DMARC Pass/Fail Over Time",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (dmarc_aligned) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json dmarc_aligned, count | __error__=\"\" | unwrap count [1d]))",
|
|
"legendFormat": "{{dmarc_aligned}}",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "Messages",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"gradientMode": "scheme",
|
|
"lineInterpolation": "smooth",
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "normal"
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "none"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#E0B400",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "quarantine"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#FF9830",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "reject"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "#F2495C",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 20
|
|
},
|
|
"id": 7,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"title": "Disposition Over Time",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (disposition) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json disposition, count | label_format disposition=`{{ or .disposition \"unknown\" }}` | __error__=\"\" | unwrap count [1d]))",
|
|
"legendFormat": "{{disposition}}",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "dark-blue"
|
|
},
|
|
"displayName": "Total Message Count",
|
|
"mappings": [
|
|
{
|
|
"options": {
|
|
"match": "null",
|
|
"result": {
|
|
"text": "N/A"
|
|
}
|
|
},
|
|
"type": "special"
|
|
}
|
|
],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "dark-blue",
|
|
"value": null
|
|
}
|
|
]
|
|
},
|
|
"unit": "locale"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": {
|
|
"h": 4,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 29
|
|
},
|
|
"id": 8,
|
|
"options": {
|
|
"colorMode": "background",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"orientation": "auto",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "value_and_name"
|
|
},
|
|
"title": "",
|
|
"transparent": true,
|
|
"type": "stat",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json count | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "Messages",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 33
|
|
},
|
|
"id": 9,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Reports by Source Domain",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (source_base_domain) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json source_base_domain, count | label_format source_base_domain=`{{ or .source_base_domain \"unknown\" }}` | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"source_base_domain": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"source_base_domain": "Source Domain",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Reports"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-blue",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 33
|
|
},
|
|
"id": 10,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Reports"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Reports by Organization",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "count by (org_name, org_extra_contact_info) (sum by (org_name, org_extra_contact_info, report_id) (count_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json org_name, org_extra_contact_info, report_id [$__range])))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"org_name": 0,
|
|
"org_extra_contact_info": 1,
|
|
"Value #A": 2
|
|
},
|
|
"renameByName": {
|
|
"org_name": "Organization",
|
|
"org_extra_contact_info": "Contact",
|
|
"Value": "Reports",
|
|
"Value #A": "Reports"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "% DMARC Compliant"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 160
|
|
},
|
|
{
|
|
"id": "unit",
|
|
"value": "percent"
|
|
},
|
|
{
|
|
"id": "decimals",
|
|
"value": 1
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #B$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "% DMARC Compliant"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^metric"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.hideFrom",
|
|
"value": {
|
|
"legend": true,
|
|
"tooltip": true,
|
|
"viz": true
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 43
|
|
},
|
|
"id": 11,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Message volume and DMARC compliance by from domain",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "label_replace(sum by (header_from) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json header_from, count | __error__=\"\" | unwrap count [$__range])), \"metric\", \"Messages\", \"\", \"\")",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "label_replace(100 * sum by (header_from) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json header_from, dmarc_aligned, count | label_format passed=`{{ if eq .dmarc_aligned \"true\" }}{{ .count }}{{ else }}0{{ end }}` | __error__=\"\" | unwrap passed [$__range])) / sum by (header_from) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json header_from, count | __error__=\"\" | unwrap count [$__range])), \"metric\", \"% DMARC Compliant\", \"\", \"\")",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "B"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "joinByField",
|
|
"options": {
|
|
"byField": "header_from",
|
|
"mode": "outer"
|
|
}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true,
|
|
"metric": true,
|
|
"metric 1": true,
|
|
"metric 2": true
|
|
},
|
|
"indexByName": {
|
|
"header_from": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"header_from": "From Domain",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages",
|
|
"Value #B": "% DMARC Compliant"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 43
|
|
},
|
|
"id": 12,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Reports by Source Country",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (source_country) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json source_country, count | label_format source_country=`{{ or .source_country \"unknown\" }}` | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"source_country": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"source_country": "Country",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "DMARC Passed"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "dark-red",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-green",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "SPF Aligned"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "DKIM Aligned"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Disposition"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 100
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Country"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 80
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Messages"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 12,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 53
|
|
},
|
|
"id": 13,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Reports by Source",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (source_ip_address, source_reverse_dns, source_base_domain, source_country) (sum_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json source_ip_address, source_reverse_dns, source_base_domain, source_country, count | __error__=\"\" | unwrap count [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"source_ip_address": 0,
|
|
"source_reverse_dns": 1,
|
|
"source_base_domain": 2,
|
|
"source_country": 3,
|
|
"Value #A": 4
|
|
},
|
|
"renameByName": {
|
|
"source_ip_address": "Source IP",
|
|
"source_reverse_dns": "Reverse DNS",
|
|
"source_base_domain": "Source Domain",
|
|
"source_country": "Country",
|
|
"Value": "Messages",
|
|
"Value #A": "Messages"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "SPF Aligned"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "DKIM Aligned"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "DMARC Passed"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "dark-red",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-green",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Disposition"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 100
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Country"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 14,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 65
|
|
},
|
|
"id": 14,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Aggregate Report Details",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "{job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"}",
|
|
"maxLines": 5000,
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "extractFields",
|
|
"options": {
|
|
"source": "Line",
|
|
"format": "json",
|
|
"replace": true,
|
|
"keepTime": false,
|
|
"jsonPaths": [
|
|
{
|
|
"path": "org_name",
|
|
"alias": "Organization"
|
|
},
|
|
{
|
|
"path": "source_ip_address",
|
|
"alias": "Source IP"
|
|
},
|
|
{
|
|
"path": "source_reverse_dns",
|
|
"alias": "Reverse DNS"
|
|
},
|
|
{
|
|
"path": "source_base_domain",
|
|
"alias": "Source Domain"
|
|
},
|
|
{
|
|
"path": "source_country",
|
|
"alias": "Country"
|
|
},
|
|
{
|
|
"path": "header_from",
|
|
"alias": "From"
|
|
},
|
|
{
|
|
"path": "envelope_from",
|
|
"alias": "Envelope From"
|
|
},
|
|
{
|
|
"path": "disposition",
|
|
"alias": "Disposition"
|
|
},
|
|
{
|
|
"path": "dkim_aligned",
|
|
"alias": "DKIM Aligned"
|
|
},
|
|
{
|
|
"path": "spf_aligned",
|
|
"alias": "SPF Aligned"
|
|
},
|
|
{
|
|
"path": "dmarc_aligned",
|
|
"alias": "DMARC Passed"
|
|
},
|
|
{
|
|
"path": "dkim_results",
|
|
"alias": "DKIM Result"
|
|
},
|
|
{
|
|
"path": "spf_results",
|
|
"alias": "SPF Result"
|
|
},
|
|
{
|
|
"path": "count",
|
|
"alias": "Messages"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Reports"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 100
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-blue",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 79
|
|
},
|
|
"id": 15,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Reports"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Published Policies",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "count by (domain, p, sp, adkim, aspf, pct, fo) (sum by (domain, p, sp, adkim, aspf, pct, fo, org_name, report_id) (count_over_time({job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"} | json domain, p, sp, adkim, aspf, pct, fo, org_name, report_id [$__range])))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"domain": 0,
|
|
"p": 1,
|
|
"sp": 2,
|
|
"adkim": 3,
|
|
"aspf": 4,
|
|
"pct": 5,
|
|
"fo": 6,
|
|
"Value #A": 7
|
|
},
|
|
"renameByName": {
|
|
"domain": "Domain",
|
|
"p": "Policy (p)",
|
|
"sp": "Subdomain Policy (sp)",
|
|
"adkim": "DKIM Alignment (adkim)",
|
|
"aspf": "SPF Alignment (aspf)",
|
|
"pct": "Percentage (pct)",
|
|
"fo": "Failure Options (fo)",
|
|
"Value": "Reports",
|
|
"Value #A": "Reports"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "SPF Aligned"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "SPF Result"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 12,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 89
|
|
},
|
|
"id": 16,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "SPF Detail",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "{job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"}",
|
|
"maxLines": 5000,
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "extractFields",
|
|
"options": {
|
|
"source": "Line",
|
|
"format": "json",
|
|
"replace": true,
|
|
"keepTime": false,
|
|
"jsonPaths": [
|
|
{
|
|
"path": "header_from",
|
|
"alias": "From"
|
|
},
|
|
{
|
|
"path": "envelope_from",
|
|
"alias": "Envelope From"
|
|
},
|
|
{
|
|
"path": "source_base_domain",
|
|
"alias": "Source Domain"
|
|
},
|
|
{
|
|
"path": "spf_aligned",
|
|
"alias": "SPF Aligned"
|
|
},
|
|
{
|
|
"path": "spf_domains",
|
|
"alias": "SPF Domain"
|
|
},
|
|
{
|
|
"path": "spf_scopes",
|
|
"alias": "SPF Scope"
|
|
},
|
|
{
|
|
"path": "spf_results",
|
|
"alias": "SPF Result"
|
|
},
|
|
{
|
|
"path": "count",
|
|
"alias": "Messages"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Messages"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 100
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "DKIM Aligned"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "DKIM Result"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 110
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 12,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 101
|
|
},
|
|
"id": 17,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Messages"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "DKIM Detail",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "{job=\"parsedmarc\", report_type=\"aggregate\", domain=~\"$domain\"}",
|
|
"maxLines": 5000,
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "extractFields",
|
|
"options": {
|
|
"source": "Line",
|
|
"format": "json",
|
|
"replace": true,
|
|
"keepTime": false,
|
|
"jsonPaths": [
|
|
{
|
|
"path": "header_from",
|
|
"alias": "From"
|
|
},
|
|
{
|
|
"path": "source_base_domain",
|
|
"alias": "Source Domain"
|
|
},
|
|
{
|
|
"path": "dkim_aligned",
|
|
"alias": "DKIM Aligned"
|
|
},
|
|
{
|
|
"path": "dkim_domains",
|
|
"alias": "DKIM Domain"
|
|
},
|
|
{
|
|
"path": "dkim_selectors",
|
|
"alias": "DKIM Selector"
|
|
},
|
|
{
|
|
"path": "dkim_results",
|
|
"alias": "DKIM Result"
|
|
},
|
|
{
|
|
"path": "count",
|
|
"alias": "Messages"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collapsed": false,
|
|
"gridPos": {
|
|
"h": 1,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 113
|
|
},
|
|
"id": 200,
|
|
"panels": [],
|
|
"title": "DMARC Failure",
|
|
"type": "row"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Source IP"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 140
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Country"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 80
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Feedback Type"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 130
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Arrival Date"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 160
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Auth Failure"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 14,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 114
|
|
},
|
|
"id": 18,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Arrival Date"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Failure Reports",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "{job=\"parsedmarc\", report_type=\"failure\"}",
|
|
"maxLines": 5000,
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "extractFields",
|
|
"options": {
|
|
"source": "Line",
|
|
"format": "json",
|
|
"replace": true,
|
|
"keepTime": false,
|
|
"jsonPaths": [
|
|
{
|
|
"path": "arrival_date_utc",
|
|
"alias": "Arrival Date"
|
|
},
|
|
{
|
|
"path": "feedback_type",
|
|
"alias": "Feedback Type"
|
|
},
|
|
{
|
|
"path": "reported_domain",
|
|
"alias": "Reported Domain"
|
|
},
|
|
{
|
|
"path": "source_ip_address",
|
|
"alias": "Source IP"
|
|
},
|
|
{
|
|
"path": "source_reverse_dns",
|
|
"alias": "Reverse DNS"
|
|
},
|
|
{
|
|
"path": "source_base_domain",
|
|
"alias": "Source Domain"
|
|
},
|
|
{
|
|
"path": "source_country",
|
|
"alias": "Country"
|
|
},
|
|
{
|
|
"path": "auth_failure",
|
|
"alias": "Auth Failure"
|
|
},
|
|
{
|
|
"path": "authentication_results",
|
|
"alias": "Auth Results"
|
|
},
|
|
{
|
|
"path": "delivery_result",
|
|
"alias": "Delivery Result"
|
|
},
|
|
{
|
|
"path": "dkim_domain",
|
|
"alias": "DKIM Domain"
|
|
},
|
|
{
|
|
"path": "subject",
|
|
"alias": "Subject"
|
|
},
|
|
{
|
|
"path": "original_mail_from",
|
|
"alias": "Mail From"
|
|
},
|
|
{
|
|
"path": "original_rcpt_to",
|
|
"alias": "Rcpt To"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Reports"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 5
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 128
|
|
},
|
|
"id": 19,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Reports"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Failure Reports by Source Country",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (source_country) (count_over_time({job=\"parsedmarc\", report_type=\"failure\"} | json source_country [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"source_country": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"source_country": "Country",
|
|
"Value": "Reports",
|
|
"Value #A": "Reports"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Reports"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 120
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 5
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byRegexp",
|
|
"options": "^Value #A$"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "displayName",
|
|
"value": "Reports"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 10,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 128
|
|
},
|
|
"id": 20,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Reports"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "Failure Reports by Source Domain",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum by (source_base_domain, source_country, source_ip_address, source_reverse_dns) (count_over_time({job=\"parsedmarc\", report_type=\"failure\"} | json source_base_domain, source_country, source_ip_address, source_reverse_dns [$__range]))",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"source_base_domain": 0,
|
|
"source_country": 1,
|
|
"source_ip_address": 2,
|
|
"source_reverse_dns": 3,
|
|
"Value #A": 4
|
|
},
|
|
"renameByName": {
|
|
"source_base_domain": "Source Domain",
|
|
"source_country": "Country",
|
|
"source_ip_address": "Source IP",
|
|
"source_reverse_dns": "Reverse DNS",
|
|
"Value": "Reports",
|
|
"Value #A": "Reports"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collapsed": false,
|
|
"gridPos": {
|
|
"h": 1,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 138
|
|
},
|
|
"id": 300,
|
|
"panels": [],
|
|
"title": "SMTP TLS",
|
|
"type": "row"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "Sessions",
|
|
"drawStyle": "bars",
|
|
"fillOpacity": 80,
|
|
"gradientMode": "scheme",
|
|
"lineWidth": 1,
|
|
"pointSize": 5,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"stacking": {
|
|
"group": "A",
|
|
"mode": "normal"
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Successful"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-green",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Failed"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-red",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 12,
|
|
"x": 0,
|
|
"y": 139
|
|
},
|
|
"id": 21,
|
|
"options": {
|
|
"legend": {
|
|
"calcs": [],
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"title": "SMTP TLS Sessions Over Time",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(sum_over_time({job=\"parsedmarc\", report_type=\"smtp_tls\"} | json policy_type, successful_session_count | policy_type!=\"\" | __error__=\"\" | unwrap successful_session_count [1d]))",
|
|
"legendFormat": "Successful",
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "sum(sum_over_time({job=\"parsedmarc\", report_type=\"smtp_tls\"} | json policy_type, failed_session_count | policy_type!=\"\" | __error__=\"\" | unwrap failed_session_count [1d]))",
|
|
"legendFormat": "Failed",
|
|
"queryType": "range",
|
|
"refId": "B"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"hideFrom": {
|
|
"legend": false,
|
|
"tooltip": false,
|
|
"viz": false
|
|
}
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Successful"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-green",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Failed"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "color",
|
|
"value": {
|
|
"fixedColor": "dark-red",
|
|
"mode": "fixed"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 9,
|
|
"w": 12,
|
|
"x": 12,
|
|
"y": 139
|
|
},
|
|
"id": 22,
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "right",
|
|
"showLegend": true
|
|
},
|
|
"pieType": "donut",
|
|
"reduceOptions": {
|
|
"calcs": [
|
|
"lastNotNull"
|
|
],
|
|
"fields": "",
|
|
"values": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "single"
|
|
}
|
|
},
|
|
"title": "SMTP TLS Session Success/Failure",
|
|
"transparent": true,
|
|
"type": "piechart",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "label_replace(sum(sum_over_time({job=\"parsedmarc\", report_type=\"smtp_tls\"} | json policy_type, successful_session_count | policy_type!=\"\" | __error__=\"\" | unwrap successful_session_count [$__range])), \"result\", \"Successful\", \"\", \"\")",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "label_replace(sum(sum_over_time({job=\"parsedmarc\", report_type=\"smtp_tls\"} | json policy_type, failed_session_count | policy_type!=\"\" | __error__=\"\" | unwrap failed_session_count [$__range])), \"result\", \"Failed\", \"\", \"\")",
|
|
"legendFormat": "",
|
|
"queryType": "instant",
|
|
"refId": "B"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "labelsToFields",
|
|
"options": {
|
|
"mode": "columns"
|
|
}
|
|
},
|
|
{
|
|
"id": "merge",
|
|
"options": {}
|
|
},
|
|
{
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true,
|
|
"Time 1": true,
|
|
"Time 2": true
|
|
},
|
|
"indexByName": {
|
|
"result": 0,
|
|
"Value #A": 1
|
|
},
|
|
"renameByName": {
|
|
"result": "result",
|
|
"Value": "Sessions",
|
|
"Value #A": "Sessions"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Successful Sessions"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 150
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-green",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Failed Sessions"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 130
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 12,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 148
|
|
},
|
|
"id": 23,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Failed Sessions"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "SMTP TLS Policies",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "{job=\"parsedmarc\", report_type=\"smtp_tls\"} | json policy_type | policy_type!=\"\"",
|
|
"maxLines": 5000,
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "extractFields",
|
|
"options": {
|
|
"source": "Line",
|
|
"format": "json",
|
|
"replace": true,
|
|
"keepTime": false,
|
|
"jsonPaths": [
|
|
{
|
|
"path": "organization_name",
|
|
"alias": "Organization"
|
|
},
|
|
{
|
|
"path": "begin_date",
|
|
"alias": "Begin"
|
|
},
|
|
{
|
|
"path": "end_date",
|
|
"alias": "End"
|
|
},
|
|
{
|
|
"path": "policy_domain",
|
|
"alias": "Policy Domain"
|
|
},
|
|
{
|
|
"path": "policy_type",
|
|
"alias": "Policy Type"
|
|
},
|
|
{
|
|
"path": "policy_strings",
|
|
"alias": "Policy Strings"
|
|
},
|
|
{
|
|
"path": "successful_session_count",
|
|
"alias": "Successful Sessions"
|
|
},
|
|
{
|
|
"path": "failed_session_count",
|
|
"alias": "Failed Sessions"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"align": "auto",
|
|
"filterable": true,
|
|
"inspect": true
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "red",
|
|
"value": 80
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": [
|
|
{
|
|
"matcher": {
|
|
"id": "byName",
|
|
"options": "Failed Sessions"
|
|
},
|
|
"properties": [
|
|
{
|
|
"id": "custom.width",
|
|
"value": 130
|
|
},
|
|
{
|
|
"id": "thresholds",
|
|
"value": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "transparent",
|
|
"value": null
|
|
},
|
|
{
|
|
"color": "dark-red",
|
|
"value": 1
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"id": "custom.cellOptions",
|
|
"value": {
|
|
"mode": "gradient",
|
|
"type": "color-background"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"gridPos": {
|
|
"h": 12,
|
|
"w": 24,
|
|
"x": 0,
|
|
"y": 160
|
|
},
|
|
"id": 24,
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"desc": true,
|
|
"displayName": "Failed Sessions"
|
|
}
|
|
],
|
|
"cellHeight": "sm",
|
|
"footer": {
|
|
"show": false
|
|
}
|
|
},
|
|
"title": "SMTP TLS Failure Details",
|
|
"type": "table",
|
|
"targets": [
|
|
{
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"editorMode": "code",
|
|
"expr": "{job=\"parsedmarc\", report_type=\"smtp_tls\"} | json result_type | result_type!=\"\"",
|
|
"maxLines": 5000,
|
|
"queryType": "range",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"id": "extractFields",
|
|
"options": {
|
|
"source": "Line",
|
|
"format": "json",
|
|
"replace": true,
|
|
"keepTime": false,
|
|
"jsonPaths": [
|
|
{
|
|
"path": "organization_name",
|
|
"alias": "Organization"
|
|
},
|
|
{
|
|
"path": "report_id",
|
|
"alias": "Report ID"
|
|
},
|
|
{
|
|
"path": "result_type",
|
|
"alias": "Result Type"
|
|
},
|
|
{
|
|
"path": "sending_mta_ip",
|
|
"alias": "Sending MTA IP"
|
|
},
|
|
{
|
|
"path": "receiving_ip",
|
|
"alias": "Receiving IP"
|
|
},
|
|
{
|
|
"path": "receiving_mx_hostname",
|
|
"alias": "Receiving MX"
|
|
},
|
|
{
|
|
"path": "failure_reason_code",
|
|
"alias": "Failure Reason"
|
|
},
|
|
{
|
|
"path": "additional_info_uri",
|
|
"alias": "Additional Info"
|
|
},
|
|
{
|
|
"path": "failed_session_count",
|
|
"alias": "Failed Sessions"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"refresh": "1m",
|
|
"schemaVersion": 39,
|
|
"tags": [
|
|
"DKIM",
|
|
"SPF",
|
|
"DMARC",
|
|
"Email",
|
|
"Loki",
|
|
"parsedmarc"
|
|
],
|
|
"templating": {
|
|
"list": [
|
|
{
|
|
"current": {
|
|
"selected": false,
|
|
"text": "All",
|
|
"value": "$__all"
|
|
},
|
|
"datasource": {
|
|
"type": "loki",
|
|
"uid": "${DS_LOKI}"
|
|
},
|
|
"definition": "label_values({job=\"parsedmarc\", report_type=\"aggregate\"},domain)",
|
|
"description": "Filter aggregate reports by the published policy domain",
|
|
"hide": 0,
|
|
"includeAll": true,
|
|
"allValue": ".*",
|
|
"label": "Domain",
|
|
"multi": true,
|
|
"name": "domain",
|
|
"options": [],
|
|
"query": {
|
|
"label": "domain",
|
|
"refId": "LokiVariableQueryEditor-VariableQuery",
|
|
"stream": "{job=\"parsedmarc\", report_type=\"aggregate\"}",
|
|
"type": 1
|
|
},
|
|
"refresh": 2,
|
|
"regex": "",
|
|
"skipUrlSync": false,
|
|
"sort": 5,
|
|
"type": "query"
|
|
},
|
|
{
|
|
"auto": true,
|
|
"auto_count": 30,
|
|
"auto_min": "1h",
|
|
"current": {
|
|
"selected": false,
|
|
"text": "1d",
|
|
"value": "1d"
|
|
},
|
|
"description": "Time bucket interval",
|
|
"hide": 2,
|
|
"label": "Interval",
|
|
"name": "interval",
|
|
"options": [
|
|
{
|
|
"selected": false,
|
|
"text": "auto",
|
|
"value": "$__auto_interval_interval"
|
|
},
|
|
{
|
|
"selected": false,
|
|
"text": "1h",
|
|
"value": "1h"
|
|
},
|
|
{
|
|
"selected": false,
|
|
"text": "6h",
|
|
"value": "6h"
|
|
},
|
|
{
|
|
"selected": true,
|
|
"text": "1d",
|
|
"value": "1d"
|
|
},
|
|
{
|
|
"selected": false,
|
|
"text": "7d",
|
|
"value": "7d"
|
|
},
|
|
{
|
|
"selected": false,
|
|
"text": "14d",
|
|
"value": "14d"
|
|
},
|
|
{
|
|
"selected": false,
|
|
"text": "30d",
|
|
"value": "30d"
|
|
}
|
|
],
|
|
"query": "1h,6h,1d,7d,14d,30d",
|
|
"refresh": 2,
|
|
"skipUrlSync": false,
|
|
"type": "interval"
|
|
}
|
|
]
|
|
},
|
|
"time": {
|
|
"from": "now-7d",
|
|
"to": "now"
|
|
},
|
|
"timepicker": {
|
|
"hidden": false,
|
|
"refresh_intervals": [
|
|
"10s",
|
|
"30s",
|
|
"1m",
|
|
"5m",
|
|
"15m",
|
|
"30m",
|
|
"1h",
|
|
"2h",
|
|
"1d"
|
|
]
|
|
},
|
|
"timezone": "",
|
|
"title": "DMARC Reports — Loki",
|
|
"uid": "parsedmarc-loki",
|
|
"version": 1
|
|
}
|