amorfo77/parsedmarc
1
0 Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-11-08 18:23:38 +00:00
Code Issues Projects Releases Wiki Activity
Files
33ca4ecf71e9e2d2cf22fc4e05c2ec1f3a337bfd
parsedmarc/dashboards/grafana/Grafana-DMARC_Reports.json
T
SBINFOandClaude Opus 5.5 1c335d951f Fix empty "Message sources by name and type" Grafana panel (#920) 
The panel nests a terms aggregation on source_type.keyword under one on
source_name.keyword, with no `missing` value on the inner aggregation.
parsedmarc saves a source_name without a source_type for every source
outside the reverse DNS map: get_service_from_reverse_dns_base_domain()
returns {"name": base_domain, "type": None} when the base domain is not
in base_reverse_dns_map.csv (parsedmarc/utils.py), and the no-PTR
fallback names a source after its AS name with no type. Such a source
yields a source_name bucket with no source_type sub-bucket, and
Grafana's Elasticsearch data source then fails to build the table:
with Grafana 13.2.4 (bundled Elasticsearch data source 12.9.2) and the
reports in samples/aggregate/, the panel showed "No data" while 12
sources had no type; with `missing` set it lists all 27 name/type rows.

Set `missing` to "-" on the source_type.keyword aggregation, the
placeholder most of the dashboard's other tables use. Hand-edited
rather than re-exported, to keep the diff to one value in this
Grafana 7.4-era export.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 14:21:38 -04:00

4935 lines
130 KiB
JSON
Raw Blame History

{
"__inputs": [],
"__requires": [
{
"type": "datasource",
"id": "elasticsearch",
"name": "Elasticsearch",
"version": "7.11.2"
},
{
"type": "grafana",
"id": "grafana",
"name": "Grafana",
"version": "7.4.5"
},
{
"type": "panel",
"id": "grafana-piechart-panel",
"name": "Pie Chart",
"version": "1.6.1"
},
{
"type": "panel",
"id": "grafana-worldmap-panel",
"name": "Worldmap Panel",
"version": "0.3.2"
},
{
"type": "panel",
"id": "graph",
"name": "Graph",
"version": ""
},
{
"type": "panel",
"id": "stat",
"name": "Stat",
"version": ""
},
{
"type": "panel",
"id": "table",
"name": "Table",
"version": ""
},
{
"type": "panel",
"id": "text",
"name": "Text",
"version": "7.4.5"
}
],
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": "-- Grafana --",
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
]
},
"description": "Dashboard for reviewing reports from ParseDMARC",
"editable": true,
"gnetId": null,
"graphTooltip": 0,
"id": null,
"iteration": 1777267012724,
"links": [],
"panels": [
{
"collapsed": true,
"datasource": null,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 0
},
"id": 28,
"panels": [
{
"content": "# DMARC Summary\r\nAs the name suggests, this dashboard is the best place to start reviewing your aggregate DMARC data.\r\n\r\nAcross the top of the dashboard, three pie charts display the percentage of alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment will filter for that value.\r\n\r\n***Note***\r\nMessages should not be considered malicious just because they failed to pass DMARC; especially if you have just started collecting data. It may be a legitimate service that needs SPF and DKIM configured correctly.\r\n\r\nStart by filtering the results to only show failed DKIM alignment. While DMARC passes if a message passes SPF or DKIM alignment, only DKIM alignment remains valid when a message is forwarded without changing the from address, which is often caused by a mailbox forwarding rule. This is because DKIM signatures are part of the message headers, whereas SPF relies on SMTP session headers.\r\n\r\nUnderneath the pie charts, you can see graphs of DMARC compliance and message disposition over time.\r\n\r\nUnder the graphs you will find the most useful data tables on the dashboard. On the left, there is a list of organizations that are sending you DMARC reports. On the right, there is a list of sending servers grouped by the base domain in their reverse DNS, and below it the Message volume and DMARC compliance by from domain table, which lists email from domains with their message volume and the percentage of those messages that passed DMARC.\r\n\r\nBy hovering your mouse over a data table value and using the magnifying glass icons, you can filter on or filter out different values. Start by looking at the Top 2000 Message Sources by Reverse DNS table. Find a sender that you recognize, such as an email marketing service, hover over it, and click on the plus (+) magnifying glass icon, to add a filter that only shows results for that sender. Now, look at the Message volume and DMARC compliance by from domain table below it. That shows you the domains that a sender is sending as, and what share of that traffic is passing DMARC, which might tell you which brand/business is using a particular service. With that information, you can contact them and have them set up DKIM.\r\n\r\n***Note***\r\nIf you have a lot of B2C customers, you may see a high volume of emails as your domains coming from consumer email services, such as Google/Gmail and Yahoo! This occurs when customers have mailbox rules in place that forward emails from an old account to a new account, which is why DKIM authentication is so important, as mentioned earlier. Similar patterns may be observed with businesses who send from reverse DNS addressees of parent, subsidiary, and outdated brands.\r\n\r\n***Note***\r\nYou can add your own custom temporary filters by clicking on Add Filter at the upper right of the page.\r\n\r\n# DMARC Failure Samples\r\nThe DMARC Failure Samples section contains information on DMARC failure reports (also known as forensic or ruf reports). These reports contain samples of emails that have failed to pass DMARC.\r\n\r\n***Note***\r\nMost recipients do not send failure/ruf reports at all to avoid privacy leaks. Some recipients (notably Chinese webmail services) will only supply the headers of sample emails. Very few provide the entire email.\r\n\r\n# DMARC Alignment Guide\r\nDMARC ensures that SPF and DKIM authentication mechanisms actually authenticate against the same domain that the end user sees.\r\n\r\nA message passes a DMARC check by passing DKIM or SPF, **as long as the related indicators are also in alignment.**\r\n\r\n| \t| DKIM \t| SPF \t|\r\n|-----------\t|--------------------------------------------------------------------------------------------------------------------------------------------------\t|----------------------------------------------------------------------------------------------------------------\t|\r\n| **Passing** \t| The signature in the DKIM header is validated using a public key that is published as a DNS record of the domain name specified in the signature \t| The mail server's IP address is listed in the SPF record of the domain in the SMTP envelope's mail from header \t|\r\n| **Alignment** \t| The signing domain aligns with the domain in the message's from header \t| The domain in the SMTP envelope's mail from header aligns with the domain in the message's from header \t|\r\n\r\n\r\n# Further Reading\r\n[Demystifying DMARC: A guide to preventing email spoofing](https://seanthegeek.net/459/demystifying-dmarc/amp/)\r\n\r\n[DMARC Manual](https://menainfosec.com/wp-content/uploads/2017/12/DMARC_Service_Manual.pdf)\r\n\r\n[What is “External Destination Verification”?](https://dmarcian.com/what-is-external-destination-verification/)",
"datasource": null,
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"gridPos": {
"h": 12,
"w": 23,
"x": 0,
"y": 1
},
"id": 26,
"links": [],
"mode": "markdown",
"options": {
"content": "# DMARC Summary\r\nAs the name suggests, this dashboard is the best place to start reviewing your aggregate DMARC data.\r\n\r\nAcross the top of the dashboard, three pie charts display the percentage of alignment pass/fail for SPF, DKIM, and DMARC. Clicking on any chart segment will filter for that value.\r\n\r\n***Note***\r\nMessages should not be considered malicious just because they failed to pass DMARC; especially if you have just started collecting data. It may be a legitimate service that needs SPF and DKIM configured correctly.\r\n\r\nStart by filtering the results to only show failed DKIM alignment. While DMARC passes if a message passes SPF or DKIM alignment, only DKIM alignment remains valid when a message is forwarded without changing the from address, which is often caused by a mailbox forwarding rule. This is because DKIM signatures are part of the message headers, whereas SPF relies on SMTP session headers.\r\n\r\nUnderneath the pie charts, you can see graphs of DMARC compliance and message disposition over time.\r\n\r\nUnder the graphs you will find the most useful data tables on the dashboard. On the left, there is a list of organizations that are sending you DMARC reports. On the right, there is a list of sending servers grouped by the base domain in their reverse DNS, and below it the Message volume and DMARC compliance by from domain table, which lists email from domains with their message volume and the percentage of those messages that passed DMARC.\r\n\r\nBy hovering your mouse over a data table value and using the magnifying glass icons, you can filter on or filter out different values. Start by looking at the Top 2000 Message Sources by Reverse DNS table. Find a sender that you recognize, such as an email marketing service, hover over it, and click on the plus (+) magnifying glass icon, to add a filter that only shows results for that sender. Now, look at the Message volume and DMARC compliance by from domain table below it. That shows you the domains that a sender is sending as, and what share of that traffic is passing DMARC, which might tell you which brand/business is using a particular service. With that information, you can contact them and have them set up DKIM.\r\n\r\n***Note***\r\nIf you have a lot of B2C customers, you may see a high volume of emails as your domains coming from consumer email services, such as Google/Gmail and Yahoo! This occurs when customers have mailbox rules in place that forward emails from an old account to a new account, which is why DKIM authentication is so important, as mentioned earlier. Similar patterns may be observed with businesses who send from reverse DNS addressees of parent, subsidiary, and outdated brands.\r\n\r\n***Note***\r\nYou can add your own custom temporary filters by clicking on Add Filter at the upper right of the page.\r\n\r\n# DMARC Failure Samples\r\nThe DMARC Failure Samples section contains information on DMARC failure reports (also known as forensic or ruf reports). These reports contain samples of emails that have failed to pass DMARC.\r\n\r\n***Note***\r\nMost recipients do not send failure/ruf reports at all to avoid privacy leaks. Some recipients (notably Chinese webmail services) will only supply the headers of sample emails. Very few provide the entire email.\r\n\r\n# DMARC Alignment Guide\r\nDMARC ensures that SPF and DKIM authentication mechanisms actually authenticate against the same domain that the end user sees.\r\n\r\nA message passes a DMARC check by passing DKIM or SPF, **as long as the related indicators are also in alignment.**\r\n\r\n| \t| DKIM \t| SPF \t|\r\n|-----------\t|--------------------------------------------------------------------------------------------------------------------------------------------------\t|----------------------------------------------------------------------------------------------------------------\t|\r\n| **Passing** \t| The signature in the DKIM header is validated using a public key that is published as a DNS record of the domain name specified in the signature \t| The mail server's IP address is listed in the SPF record of the domain in the SMTP envelope's mail from header \t|\r\n| **Alignment** \t| The signing domain aligns with the domain in the message's from header \t| The domain in the SMTP envelope's mail from header aligns with the domain in the message's from header \t|\r\n\r\n\r\n# Further Reading\r\n[Demystifying DMARC: A guide to preventing email spoofing](https://seanthegeek.net/459/demystifying-dmarc/amp/)\r\n\r\n[DMARC Manual](https://menainfosec.com/wp-content/uploads/2017/12/DMARC_Service_Manual.pdf)\r\n\r\n[What is “External Destination Verification”?](https://dmarcian.com/what-is-external-destination-verification/)",
"mode": "markdown"
},
"pluginVersion": "7.1.0",
"timeFrom": null,
"timeShift": null,
"title": "",
"transparent": true,
"type": "text"
}
],
"title": "Guide",
"type": "row"
},
{
"collapsed": false,
"datasource": null,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 1
},
"id": 30,
"panels": [],
"title": "DMARC Summary",
"type": "row"
},
{
"aliasColors": {
"false": "#E0B400",
"true": "#37872D"
},
"breakPoint": "50%",
"cacheTimeout": null,
"combine": {
"label": "Others",
"threshold": 0
},
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fontSize": "120%",
"format": "none",
"gridPos": {
"h": 9,
"w": 8,
"x": 0,
"y": 2
},
"id": 6,
"interval": null,
"legend": {
"percentage": false,
"show": true,
"values": false
},
"legendType": "Right side",
"links": [],
"maxDataPoints": 3,
"nullPointMode": "connected",
"pieType": "donut",
"strokeWidth": "4",
"targets": [
{
"alias": "",
"bucketAggs": [
{
"$$hashKey": "object:243",
"fake": true,
"field": "spf_aligned",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:244",
"field": "date_begin",
"id": "2",
"settings": {
"interval": "auto",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:241",
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "SPF Alignment",
"transparent": true,
"type": "grafana-piechart-panel",
"valueName": "total"
},
{
"aliasColors": {
"false": "#E0B400",
"true": "#37872D"
},
"breakPoint": "50%",
"cacheTimeout": null,
"combine": {
"label": "Others",
"threshold": 0
},
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fontSize": "120%",
"format": "none",
"gridPos": {
"h": 9,
"w": 8,
"x": 8,
"y": 2
},
"id": 2,
"interval": null,
"legend": {
"percentage": false,
"show": true,
"values": false
},
"legendType": "Right side",
"links": [],
"maxDataPoints": 3,
"nullPointMode": "connected",
"pieType": "donut",
"strokeWidth": "4",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "dkim_aligned",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "auto",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DKIM Alignment",
"transparent": true,
"type": "grafana-piechart-panel",
"valueName": "total"
},
{
"aliasColors": {
"false": "#C4162A",
"true": "#37872D"
},
"breakPoint": "50%",
"cacheTimeout": null,
"combine": {
"label": "Others",
"threshold": 0
},
"datasource": "$datasourceag",
"description": "",
"fieldConfig": {
"defaults": {
"custom": {}
},
"overrides": []
},
"fontSize": "120%",
"format": "none",
"gridPos": {
"h": 9,
"w": 8,
"x": 16,
"y": 2
},
"id": 5,
"interval": null,
"legend": {
"header": "",
"percentage": false,
"show": true,
"values": false
},
"legendType": "Right side",
"links": [],
"maxDataPoints": 3,
"nullPointMode": "connected",
"pieType": "donut",
"strokeWidth": "4",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:385",
"fake": true,
"field": "passed_dmarc",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:386",
"field": "date_begin",
"id": "2",
"settings": {
"interval": "auto",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:383",
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DMARC Compliance",
"transparent": true,
"type": "grafana-piechart-panel",
"valueName": "total"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 20,
"showPoints": "never",
"spanNulls": false,
"stacking": {
"mode": "none",
"group": "A"
},
"axisPlacement": "auto",
"axisLabel": "",
"scaleDistribution": {
"type": "linear"
},
"lineInterpolation": "linear"
},
"links": [
{
"title": "",
"url": ""
}
]
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Pass"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "fail"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-red"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "false"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "neutral"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "super-light-blue"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "none"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "pass"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "permerror"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-orange"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "softfail"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "super-light-green"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "temperror"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "semi-dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "true"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 12,
"x": 0,
"y": 11
},
"id": 33,
"links": [],
"options": {
"legend": {
"showLegend": true,
"displayMode": "list",
"placement": "right",
"calcs": []
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "spf_results.result.keyword",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "1d",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "SPF Results Over Time",
"type": "timeseries"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 20,
"showPoints": "never",
"spanNulls": false,
"stacking": {
"mode": "none",
"group": "A"
},
"axisPlacement": "auto",
"axisLabel": "",
"scaleDistribution": {
"type": "linear"
},
"lineInterpolation": "linear"
},
"links": []
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Pass"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "fail"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-red"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "false"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "neutral"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "super-light-blue"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "none"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "pass"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "permerror"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-orange"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "temperror"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "semi-dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "true"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 12,
"x": 12,
"y": 11
},
"id": 19,
"links": [],
"options": {
"legend": {
"showLegend": true,
"displayMode": "list",
"placement": "right",
"calcs": []
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "dkim_results.result.keyword",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "1d",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DKIM Results Over Time",
"type": "timeseries"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 20,
"showPoints": "never",
"spanNulls": false,
"stacking": {
"mode": "none",
"group": "A"
},
"axisPlacement": "auto",
"axisLabel": "",
"scaleDistribution": {
"type": "linear"
},
"lineInterpolation": "linear"
},
"links": []
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "false"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "true"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 12,
"x": 0,
"y": 20
},
"id": 18,
"links": [],
"options": {
"legend": {
"showLegend": true,
"displayMode": "list",
"placement": "right",
"calcs": []
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "spf_aligned",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "1d",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {
"missing": null
},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "SPF Alignment Over Time",
"type": "timeseries"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 20,
"showPoints": "never",
"spanNulls": false,
"stacking": {
"mode": "none",
"group": "A"
},
"axisPlacement": "auto",
"axisLabel": "",
"scaleDistribution": {
"type": "linear"
},
"lineInterpolation": "linear"
},
"links": []
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "false"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-yellow"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "true"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 12,
"x": 12,
"y": 20
},
"id": 34,
"links": [],
"options": {
"legend": {
"showLegend": true,
"displayMode": "list",
"placement": "right",
"calcs": []
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "dkim_aligned",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "1d",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {
"missing": null
},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DKIM Alignment Over Time",
"type": "timeseries"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 20,
"showPoints": "never",
"spanNulls": false,
"stacking": {
"mode": "none",
"group": "A"
},
"axisPlacement": "auto",
"axisLabel": "",
"scaleDistribution": {
"type": "linear"
},
"lineInterpolation": "linear"
},
"links": []
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "false"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-red"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "true"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 12,
"x": 0,
"y": 29
},
"id": 7,
"links": [],
"options": {
"legend": {
"showLegend": true,
"displayMode": "list",
"placement": "right",
"calcs": []
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "passed_dmarc",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "1d",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {
"missing": null
},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DMARC Compliance Over Time",
"type": "timeseries"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"drawStyle": "line",
"lineWidth": 2,
"fillOpacity": 20,
"showPoints": "never",
"spanNulls": false,
"stacking": {
"mode": "none",
"group": "A"
},
"axisPlacement": "auto",
"axisLabel": "",
"scaleDistribution": {
"type": "linear"
},
"lineInterpolation": "linear"
},
"links": []
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "none"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "dark-green"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "quarantine"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "semi-dark-orange"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "reject"
},
"properties": [
{
"id": "color",
"value": {
"mode": "fixed",
"fixedColor": "red"
}
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 12,
"x": 12,
"y": 29
},
"id": 8,
"links": [],
"options": {
"legend": {
"showLegend": true,
"displayMode": "list",
"placement": "right",
"calcs": []
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "disposition.keyword",
"id": "3",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "_term",
"size": "0"
},
"type": "terms"
},
{
"field": "date_begin",
"id": "2",
"settings": {
"interval": "1d",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Message Disposition Over Time",
"type": "timeseries"
},
{
"cacheTimeout": null,
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {},
"displayName": "Total Message Count",
"mappings": [
{
"id": 0,
"op": "=",
"text": "N/A",
"type": 1,
"value": "null"
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "dark-blue",
"value": null
}
]
},
"unit": "locale"
},
"overrides": []
},
"gridPos": {
"h": 4,
"w": 12,
"x": 0,
"y": 38
},
"id": 36,
"interval": "$interval",
"links": [],
"options": {
"colorMode": "background",
"graphMode": "area",
"justifyMode": "auto",
"orientation": "auto",
"reduceOptions": {
"calcs": ["sum"],
"fields": "",
"values": false
},
"text": {},
"textMode": "value_and_name"
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:430",
"fake": true,
"field": "date_begin",
"id": "6",
"settings": {
"interval": "auto",
"min_doc_count": 0,
"trimEdges": 0
},
"type": "date_histogram"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:428",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "",
"transparent": true,
"type": "stat"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [
{
"from": "",
"id": 0,
"text": "",
"to": "",
"type": 1
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
}
]
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 38
},
"id": 10,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:920",
"fake": true,
"field": "source_base_domain.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "none",
"order": "desc",
"orderBy": "4",
"size": "2000"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:918",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Top 2000 Message Sources by Reverse DNS",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Sum": "Messages",
"source_base_domain.keyword": "Reverse DNS Base"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reporting Organisation"
},
"properties": [
{
"id": "custom.width",
"value": 183
}
]
}
]
},
"gridPos": {
"h": 11,
"w": 12,
"x": 0,
"y": 42
},
"id": 9,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:291",
"fake": true,
"field": "org_name.keyword",
"id": "7",
"settings": {
"min_doc_count": "1",
"missing": null,
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:98",
"fake": true,
"field": "org_extra_contact_info.keyword",
"id": "6",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:96",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
},
{
"bucketAggs": [
{
"$$hashKey": "object:102",
"fake": true,
"field": "org_extra_contact_info.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": true,
"metrics": [
{
"$$hashKey": "object:100",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "B",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Reporting Organisations",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Sum": "Messages",
"org_extra_contact_info.keyword": "Org Contact Info",
"org_name.keyword": "Reporting Organisation"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "From Domain"
},
"properties": [
{
"id": "links",
"value": [
{
"targetBlank": true,
"title": "Open ${__data.fields[\"From Domain\"]} in new window",
"url": "https://${__data.fields[\"From Domain\"]}"
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "% DMARC Compliant"
},
"properties": [
{
"id": "unit",
"value": "percentunit"
},
{
"id": "decimals",
"value": 1
},
{
"id": "noValue",
"value": "0"
}
]
}
]
},
"gridPos": {
"h": 7,
"w": 12,
"x": 12,
"y": 46
},
"id": 11,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:388",
"fake": true,
"field": "header_from.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "none",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:386",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
},
{
"bucketAggs": [
{
"$$hashKey": "object:389",
"fake": true,
"field": "header_from.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "none",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:387",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain AND passed_dmarc:true",
"refId": "B",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Message volume and DMARC compliance by from domain",
"transformations": [
{
"id": "joinByField",
"options": {
"byField": "header_from.keyword",
"mode": "outer"
}
},
{
"id": "calculateField",
"options": {
"alias": "% DMARC Compliant",
"mode": "binary",
"binary": {
"left": {
"matcher": {
"id": "byName",
"options": "Sum 2"
}
},
"operator": "/",
"right": {
"matcher": {
"id": "byName",
"options": "Sum 1"
}
}
},
"replaceFields": false
}
},
{
"id": "organize",
"options": {
"excludeByName": {
"Sum 2": true
},
"indexByName": {},
"renameByName": {
"Sum 1": "Messages",
"header_from.keyword": "From Domain"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"custom": {
"hideFrom": {
"tooltip": false,
"legend": false,
"viz": false
}
}
},
"overrides": []
},
"gridPos": {
"h": 10,
"w": 16,
"x": 0,
"y": 53
},
"id": 12,
"links": [],
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:710",
"fake": true,
"field": "source_country.keyword",
"id": "7",
"settings": {
"min_doc_count": 1,
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:708",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Map of Message Source Countries",
"type": "geomap",
"options": {
"view": {
"id": "zero",
"lat": 0,
"lon": 0,
"zoom": 1,
"padding": 0
},
"basemap": {
"type": "default",
"name": "Layer 0",
"config": {}
},
"layers": [
{
"type": "markers",
"name": "Sources",
"config": {
"showLegend": true,
"style": {
"color": {
"fixed": "green"
},
"opacity": 0.8,
"size": {
"field": "Sum",
"fixed": 5,
"min": 4,
"max": 30
},
"symbol": {
"fixed": "img/icons/marker/circle.svg",
"mode": "fixed"
}
}
},
"location": {
"mode": "lookup",
"lookup": "source_country.keyword",
"gazetteer": "public/gazetteer/countries.json"
},
"tooltip": true
}
],
"controls": {
"showZoom": true,
"mouseWheelZoom": true,
"showScale": false,
"showAttribution": true,
"showDebug": false,
"showMeasure": false
},
"tooltip": {
"mode": "details"
}
}
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Country"
},
"properties": [
{
"id": "custom.width",
"value": 70
}
]
},
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 8,
"x": 16,
"y": 53
},
"id": 39,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:524",
"fake": true,
"field": "source_country.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "none",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:522",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Message Source Countries",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Sum": "Messages",
"source_country.keyword": "Country"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
},
{
"id": "custom.align",
"value": "left"
},
{
"id": "custom.width",
"value": 400
}
]
},
{
"matcher": {
"id": "byName",
"options": "Date"
},
"properties": [
{
"id": "unit",
"value": "dateTimeAsIso"
}
]
},
{
"matcher": {
"id": "byName",
"options": "Country"
},
"properties": [
{
"id": "custom.width",
"value": 66
}
]
},
{
"matcher": {
"id": "byName",
"options": "Source IP"
},
"properties": [
{
"id": "custom.width",
"value": 120
}
]
},
{
"matcher": {
"id": "byName",
"options": "SPF"
},
"properties": [
{
"id": "custom.width",
"value": 56
}
]
},
{
"matcher": {
"id": "byName",
"options": "DKIM"
},
"properties": [
{
"id": "custom.width",
"value": 62
}
]
},
{
"matcher": {
"id": "byName",
"options": "SPF Scope / Domain / Result"
},
"properties": [
{
"id": "custom.width",
"value": 200
}
]
},
{
"matcher": {
"id": "byName",
"options": "DKIM Selector / Domain / Result"
},
"properties": [
{
"id": "custom.width",
"value": 260
}
]
},
{
"matcher": {
"id": "byName",
"options": "Disposition"
},
"properties": [
{
"id": "custom.width",
"value": 106
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 63
},
"id": 41,
"interval": "1d",
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:457",
"fake": true,
"field": "source_base_domain.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:458",
"fake": true,
"field": "source_reverse_dns.keyword",
"id": "7",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:459",
"fake": true,
"field": "source_ip_address.keyword",
"id": "8",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:460",
"fake": true,
"field": "source_country.keyword",
"id": "9",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:384",
"fake": true,
"field": "disposition.keyword",
"id": "12",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:391",
"fake": true,
"field": "spf_aligned",
"id": "13",
"settings": {
"min_doc_count": "1",
"missing": "false",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:398",
"fake": true,
"field": "dkim_aligned",
"id": "14",
"settings": {
"min_doc_count": "1",
"missing": "false",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:405",
"fake": true,
"field": "org_name.keyword",
"id": "15",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:412",
"fake": true,
"field": "spf_results_combined.keyword",
"id": "16",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:622",
"fake": true,
"field": "header_from.keyword",
"id": "17",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
},
{
"$$hashKey": "object:461",
"fake": true,
"field": "dkim_results_combined.keyword",
"id": "10",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "50"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:455",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Overview",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {
"Sum": 11,
"disposition.keyword": 4,
"dkim_aligned": 6,
"dkim_results_combined.keyword": 9,
"header_from.keyword": 10,
"org_name.keyword": 7,
"source_base_domain.keyword": 0,
"source_country.keyword": 3,
"source_ip_address.keyword": 2,
"source_reverse_dns.keyword": 1,
"spf_aligned": 5,
"spf_results_combined.keyword": 8
},
"renameByName": {
"Sum": "Messages",
"date_range": "Date",
"disposition.keyword": "Disposition",
"dkim_aligned": "DKIM",
"dkim_results_combined.keyword": "DKIM Selector / Domain / Result",
"envelope_from.keyword": "Envelope From",
"header_from.keyword": "Email Domain",
"org_name.keyword": "Reporter",
"source_base_domain.keyword": "Sending Domain",
"source_country.keyword": "Country",
"source_ip_address.keyword": "Source IP",
"source_reverse_dns.keyword": "PTR",
"spf_aligned": "SPF",
"spf_results_combined.keyword": "SPF Scope / Domain / Result"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [
{
"from": "",
"id": 0,
"text": "relaxed",
"to": "",
"type": 1,
"value": "r"
},
{
"from": "",
"id": 1,
"text": "strict",
"to": "",
"type": 1,
"value": "s"
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
},
{
"id": "custom.align",
"value": "left"
},
{
"id": "custom.width",
"value": 400
}
]
},
{
"matcher": {
"id": "byName",
"options": "Percentage"
},
"properties": [
{
"id": "unit",
"value": "percent"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "dark-yellow",
"value": null
},
{
"color": "dark-green",
"value": 100
}
]
}
},
{
"id": "custom.displayMode",
"value": "color-background"
},
{
"id": "custom.width",
"value": 90
}
]
},
{
"matcher": {
"id": "byName",
"options": "Subdomain Policy"
},
"properties": [
{
"id": "custom.width",
"value": 128
}
]
},
{
"matcher": {
"id": "byName",
"options": "Policy"
},
"properties": [
{
"id": "custom.width",
"value": 90
}
]
},
{
"matcher": {
"id": "byName",
"options": "Failure Policy"
},
"properties": [
{
"id": "custom.width",
"value": 126
}
]
},
{
"matcher": {
"id": "byName",
"options": "SPF Policy"
},
"properties": [
{
"id": "custom.width",
"value": 121
}
]
},
{
"matcher": {
"id": "byName",
"options": "DKIM Policy"
},
"properties": [
{
"id": "custom.width",
"value": 100
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 72
},
"id": 43,
"interval": "86399",
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:457",
"fake": true,
"field": "published_policy.adkim.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:458",
"fake": true,
"field": "published_policy.aspf.keyword",
"id": "7",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:459",
"fake": true,
"field": "published_policy.domain.keyword",
"id": "8",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:460",
"fake": true,
"field": "published_policy.fo.keyword",
"id": "9",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:384",
"fake": true,
"field": "published_policy.p.keyword",
"id": "12",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:391",
"fake": true,
"field": "published_policy.pct",
"id": "13",
"settings": {
"min_doc_count": "1",
"missing": null,
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:398",
"fake": true,
"field": "published_policy.sp.keyword",
"id": "14",
"settings": {
"min_doc_count": "1",
"missing": "false",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:455",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Published Policies (as reported)",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {
"date_range": false
},
"indexByName": {
"Sum": 7,
"published_policy.adkim.keyword": 1,
"published_policy.aspf.keyword": 2,
"published_policy.domain.keyword": 0,
"published_policy.fo.keyword": 3,
"published_policy.p.keyword": 4,
"published_policy.pct": 5,
"published_policy.sp.keyword": 6
},
"renameByName": {
"Sum": "Messages",
"date_range": "Date",
"disposition.keyword": "Applied Policy",
"dkim_aligned": "DKIM",
"dkim_results.domain.keyword": "DKIM Domain",
"dkim_results.result.keyword": "DKIM Auth Result",
"dkim_results.selector.keyword": "DKIM Selector",
"envelope_from.keyword": "Envelope From",
"header_from.keyword": "Header From",
"org_name.keyword": "Reporter",
"published_policy.adkim.keyword": "DKIM Policy",
"published_policy.aspf.keyword": "SPF Policy",
"published_policy.domain.keyword": "Domain",
"published_policy.fo.keyword": "Failure Policy",
"published_policy.p.keyword": "Policy",
"published_policy.pct": "Percentage",
"published_policy.sp.keyword": "Subdomain Policy",
"source_base_domain.keyword": "Reverse DNS Base",
"source_country.keyword": "Country",
"source_ip_address.keyword": "Source IP",
"source_reverse_dns.keyword": "PTR",
"spf_aligned": "SPF",
"spf_results.result.keyword": "SPF Auth Result"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "IP Address"
},
"properties": [
{
"id": "custom.width",
"value": 140
}
]
},
{
"matcher": {
"id": "byName",
"options": "Country"
},
"properties": [
{
"id": "custom.width",
"value": 80
}
]
},
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.width",
"value": 400
},
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
},
{
"id": "custom.align",
"value": "left"
}
]
},
{
"matcher": {
"id": "byName",
"options": "Base Domain"
},
"properties": [
{
"id": "custom.width",
"value": 300
},
{
"id": "links",
"value": [
{
"targetBlank": true,
"title": "Visit Domain",
"url": "https://${__data.fields[\"source_base_domain.keyword\"]}"
}
]
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 81
},
"id": 14,
"interval": "",
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:921",
"fake": true,
"field": "source_ip_address.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "1000"
},
"type": "terms"
},
{
"$$hashKey": "object:922",
"fake": true,
"field": "source_reverse_dns.keyword",
"id": "7",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "1000"
},
"type": "terms"
},
{
"$$hashKey": "object:923",
"fake": true,
"field": "source_base_domain.keyword",
"id": "8",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "1000"
},
"type": "terms"
},
{
"$$hashKey": "object:924",
"fake": true,
"field": "source_country.keyword",
"id": "9",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "1000"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:919",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Top 1000 Message Source IP Addresses",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Sum": "Messages",
"source_base_domain.keyword": "Base Domain",
"source_country.keyword": "Country",
"source_ip_address.keyword": "IP Address",
"source_reverse_dns.keyword": "Reverse DNS"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
},
{
"id": "custom.align",
"value": "left"
},
{
"id": "custom.width",
"value": 400
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reverse DNS Base"
},
"properties": [
{
"id": "links",
"value": [
{
"targetBlank": true,
"title": "Visit Domain",
"url": "https://${__data.fields[\"source_base_domain.keyword\"]}"
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Header From"
},
"properties": [
{
"id": "links",
"value": [
{
"targetBlank": true,
"title": "Check ${__data.fields[\"header_from.keyword\"]} SPF record",
"url": "https://dmarcian.com/spf-survey/?domain=${__data.fields[\"header_from.keyword\"]}"
}
]
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 90
},
"id": 16,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:457",
"fake": true,
"field": "header_from.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:458",
"fake": true,
"field": "envelope_from.keyword",
"id": "7",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:459",
"fake": true,
"field": "spf_results_combined.keyword",
"id": "8",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:460",
"fake": true,
"field": "spf_aligned",
"id": "9",
"settings": {
"min_doc_count": 1,
"missing": null,
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:461",
"fake": true,
"field": "source_base_domain.keyword",
"id": "10",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:455",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "SPF Alignment Details",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Sum": "Messages",
"envelope_from.keyword": "Envelope From",
"header_from.keyword": "Header From",
"source_base_domain.keyword": "Reverse DNS Base",
"spf_aligned": "SPF Aligned",
"spf_results_combined.keyword": "SPF Scope / Domain / Result"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
},
{
"id": "custom.align",
"value": "left"
},
{
"id": "custom.width",
"value": 400
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reverse DNS Base"
},
"properties": [
{
"id": "links",
"value": [
{
"targetBlank": true,
"title": "Visit Domain",
"url": "https://${__data.fields[\"source_base_domain.keyword\"]}"
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "DKIM Selector / Domain / Result"
},
"properties": [
{
"id": "custom.width",
"value": 400
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 99
},
"id": 40,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:457",
"fake": true,
"field": "header_from.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:458",
"fake": true,
"field": "dkim_results_combined.keyword",
"id": "7",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:798",
"fake": true,
"field": "dkim_aligned",
"id": "11",
"settings": {
"min_doc_count": "1",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:461",
"fake": true,
"field": "source_base_domain.keyword",
"id": "10",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "4",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:455",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DKIM Alignment Details",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Sum": "Messages",
"dkim_aligned": "DKIM Aligned",
"dkim_results_combined.keyword": "DKIM Selector / Domain / Result",
"envelope_from.keyword": "Envelope From",
"header_from.keyword": "Header From",
"source_base_domain.keyword": "Reverse DNS Base",
"spf_aligned": "SPF Aligned"
}
}
}
],
"type": "table"
},
{
"collapsed": false,
"datasource": null,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 108
},
"id": 32,
"panels": [],
"title": "DMARC Failure",
"type": "row"
},
{
"datasource": "$datasourcefo",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Arrival Date (UTC)"
},
"properties": [
{
"id": "unit",
"value": "dateTimeAsSystem"
}
]
},
{
"matcher": {
"id": "byName",
"options": "AuthFailure"
},
"properties": [
{
"id": "custom.width",
"value": 84
}
]
},
{
"matcher": {
"id": "byName",
"options": "DeliveryResult"
},
"properties": [
{
"id": "custom.width",
"value": 104
}
]
},
{
"matcher": {
"id": "byName",
"options": "Count"
},
"properties": [
{
"id": "custom.width",
"value": 71
}
]
},
{
"matcher": {
"id": "byName",
"options": "ReplyTo"
},
"properties": [
{
"id": "custom.width",
"value": 122
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 24,
"x": 0,
"y": 109
},
"id": 20,
"links": [],
"options": {
"showHeader": true,
"sortBy": []
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:340",
"fake": true,
"field": "Arrival Date (UTC)",
"id": "6",
"settings": {
"interval": "auto",
"min_doc_count": 1,
"trimEdges": 0
},
"type": "date_histogram"
},
{
"$$hashKey": "object:341",
"fake": true,
"field": "sample.headers.from.keyword",
"id": "7",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:342",
"fake": true,
"field": "sample.headers.to.keyword",
"id": "8",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:343",
"fake": true,
"field": "sample.headers.reply-to.keyword",
"id": "10",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:344",
"fake": true,
"field": "auth_failure.keyword",
"id": "11",
"settings": {
"min_doc_count": 1,
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:345",
"fake": true,
"field": "sample.subject.keyword",
"id": "12",
"settings": {
"min_doc_count": 1,
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:346",
"fake": true,
"field": "delivery_results.keyword",
"id": "14",
"settings": {
"min_doc_count": 1,
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:347",
"fake": true,
"field": "authentication_results.keyword",
"id": "15",
"settings": {
"min_doc_count": 1,
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
},
{
"$$hashKey": "object:348",
"fake": true,
"field": "sample.headers.received.keyword",
"id": "13",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:338",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "count"
}
],
"query": "domain.keyword:$fromdomain",
"refId": "A",
"timeField": "arrival_date"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Failure Samples",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Count": "Count",
"arrival_date_utc": "Arrival_Date(UTC)",
"auth_failure.keyword": "AuthFailure",
"authentication_results.keyword": "Auth Results",
"delivery_results.keyword": "DeliveryResult",
"sample.headers.from.keyword": "From",
"sample.headers.received.keyword": "Received",
"sample.headers.reply-to.keyword": "ReplyTo",
"sample.headers.to.keyword": "To",
"sample.subject.keyword": "Subject"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourcefo",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"custom": {
"hideFrom": {
"tooltip": false,
"legend": false,
"viz": false
}
}
},
"overrides": []
},
"gridPos": {
"h": 11,
"w": 8,
"x": 0,
"y": 118
},
"id": 22,
"links": [],
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:60",
"fake": true,
"field": "source_country.keyword",
"id": "9",
"settings": {
"min_doc_count": 1,
"order": "desc",
"orderBy": "_term",
"size": "10"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:58",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "count"
}
],
"query": "domain.keyword:$fromdomain",
"refId": "A",
"timeField": "arrival_date"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Failure Sample Sources by Country",
"type": "geomap",
"options": {
"view": {
"id": "zero",
"lat": 0,
"lon": 0,
"zoom": 1,
"padding": 0
},
"basemap": {
"type": "default",
"name": "Layer 0",
"config": {}
},
"layers": [
{
"type": "markers",
"name": "Sources",
"config": {
"showLegend": true,
"style": {
"color": {
"fixed": "dark-green"
},
"opacity": 0.5,
"size": {
"fixed": 5,
"min": 2,
"max": 30
},
"symbol": {
"fixed": "img/icons/marker/circle.svg",
"mode": "fixed"
}
}
},
"location": {
"mode": "lookup",
"lookup": "source_country.keyword",
"gazetteer": "public/gazetteer/countries.json"
},
"tooltip": true
}
],
"controls": {
"showZoom": true,
"mouseWheelZoom": true,
"showScale": false,
"showAttribution": true,
"showDebug": false,
"showMeasure": false
},
"tooltip": {
"mode": "details"
}
}
},
{
"datasource": "$datasourcefo",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [
{
"from": "",
"id": 0,
"text": "",
"to": "",
"type": 1
}
],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Count"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "Country"
},
"properties": [
{
"id": "custom.width",
"value": 70
}
]
}
]
},
"gridPos": {
"h": 11,
"w": 5,
"x": 8,
"y": 118
},
"id": 23,
"links": [],
"options": {
"showHeader": true,
"sortBy": []
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:840",
"fake": true,
"field": "source_country.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "none",
"order": "desc",
"orderBy": "_count",
"size": "0"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:838",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "count"
}
],
"query": "domain.keyword:$fromdomain",
"refId": "A",
"timeField": "arrival_date"
}
],
"timeFrom": null,
"timeShift": null,
"title": "DMARC Failure Sample Source Countries",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"source_country.keyword": "Country"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourcefo",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Country"
},
"properties": [
{
"id": "custom.width",
"value": 70
}
]
},
{
"matcher": {
"id": "byName",
"options": "Base Domain"
},
"properties": [
{
"id": "links",
"value": [
{
"targetBlank": true,
"title": "Visit https://${__data.fields[\"source_base_domain.keyword\"]}",
"url": "https://${__data.fields[\"source_base_domain.keyword\"]}"
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
}
]
},
"gridPos": {
"h": 11,
"w": 11,
"x": 13,
"y": 118
},
"id": 24,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"$$hashKey": "object:653",
"fake": true,
"field": "source_ip_address.keyword",
"id": "6",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "1000"
},
"type": "terms"
},
{
"$$hashKey": "object:654",
"fake": true,
"field": "source_reverse_dns.keyword",
"id": "7",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "1000"
},
"type": "terms"
},
{
"$$hashKey": "object:655",
"fake": true,
"field": "source_base_domain.keyword",
"id": "8",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "1000"
},
"type": "terms"
},
{
"$$hashKey": "object:656",
"fake": true,
"field": "source_country.keyword",
"id": "9",
"settings": {
"min_doc_count": 1,
"missing": "-",
"order": "desc",
"orderBy": "_count",
"size": "1000"
},
"type": "terms"
}
],
"hide": false,
"metrics": [
{
"$$hashKey": "object:651",
"field": "message_count",
"id": "4",
"meta": {},
"settings": {},
"type": "count"
}
],
"query": "domain.keyword:$fromdomain",
"refId": "A",
"timeField": "arrival_date"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Top 1000 Failure Sample Source IP Addresses",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"Count": "Messages",
"source_base_domain.keyword": "Base Domain",
"source_country.keyword": "Country",
"source_ip_address.keyword": "IP Address",
"source_reverse_dns.keyword": "Reverse DNS"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "Source name"
},
"properties": [
{
"id": "custom.width",
"value": 280
}
]
},
{
"matcher": {
"id": "byName",
"options": "Source type"
},
"properties": [
{
"id": "custom.width",
"value": 200
}
]
}
]
},
"gridPos": {
"h": 11,
"w": 24,
"x": 0,
"y": 129
},
"id": 44,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "source_name.keyword",
"id": "11",
"settings": {
"min_doc_count": "1",
"missing": null,
"order": "desc",
"orderBy": "1",
"size": "0"
},
"type": "terms"
},
{
"fake": true,
"field": "source_type.keyword",
"id": "12",
"settings": {
"min_doc_count": "1",
"missing": "-",
"order": "desc",
"orderBy": "1",
"size": "0"
},
"type": "terms"
}
],
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Message sources by name and type",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"source_name.keyword": "Source name",
"source_type.keyword": "Source type",
"Sum": "Messages"
}
}
}
],
"type": "table"
},
{
"datasource": "$datasourceag",
"fieldConfig": {
"defaults": {
"custom": {
"align": null,
"filterable": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Messages"
},
"properties": [
{
"id": "custom.displayMode",
"value": "gradient-gauge"
},
{
"id": "thresholds",
"value": {
"mode": "percentage",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "dark-purple",
"value": 101
}
]
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "ASN"
},
"properties": [
{
"id": "custom.width",
"value": 100
}
]
},
{
"matcher": {
"id": "byName",
"options": "AS name"
},
"properties": [
{
"id": "custom.width",
"value": 280
}
]
},
{
"matcher": {
"id": "byName",
"options": "AS domain"
},
"properties": [
{
"id": "custom.width",
"value": 200
}
]
}
]
},
"gridPos": {
"h": 11,
"w": 24,
"x": 0,
"y": 140
},
"id": 45,
"links": [],
"options": {
"showHeader": true,
"sortBy": [
{
"desc": true,
"displayName": "Messages"
}
]
},
"pluginVersion": "7.4.5",
"targets": [
{
"bucketAggs": [
{
"fake": true,
"field": "source_asn",
"id": "11",
"settings": {
"min_doc_count": "1",
"missing": null,
"order": "desc",
"orderBy": "1",
"size": "0"
},
"type": "terms"
},
{
"fake": true,
"field": "source_as_name.keyword",
"id": "12",
"settings": {
"min_doc_count": "1",
"missing": null,
"order": "desc",
"orderBy": "1",
"size": "0"
},
"type": "terms"
},
{
"fake": true,
"field": "source_as_domain.keyword",
"id": "13",
"settings": {
"min_doc_count": "1",
"missing": null,
"order": "desc",
"orderBy": "1",
"size": "0"
},
"type": "terms"
}
],
"metrics": [
{
"field": "message_count",
"id": "1",
"meta": {},
"settings": {},
"type": "sum"
}
],
"query": "header_from.keyword:$fromdomain",
"refId": "A",
"timeField": "date_begin"
}
],
"timeFrom": null,
"timeShift": null,
"title": "Message sources by Autonomous System",
"transformations": [
{
"id": "organize",
"options": {
"excludeByName": {},
"indexByName": {},
"renameByName": {
"source_asn": "ASN",
"source_as_name.keyword": "AS name",
"source_as_domain.keyword": "AS domain",
"Sum": "Messages"
}
}
}
],
"type": "table"
}
],
"refresh": "10s",
"schemaVersion": 27,
"style": "dark",
"tags": ["DKIM", "SPF", "DMARC", "Email"],
"templating": {
"list": [
{
"current": {
"selected": false,
"text": "dmarc-ag",
"value": "dmarc-ag"
},
"description": null,
"error": null,
"hide": 2,
"includeAll": false,
"label": "Datasource: Aggregate",
"multi": false,
"name": "datasourceag",
"options": [],
"query": "elasticsearch",
"refresh": 1,
"regex": "/.*dmarc-ag/",
"skipUrlSync": false,
"type": "datasource"
},
{
"current": {
"selected": false,
"text": "dmarc-fo",
"value": "dmarc-fo"
},
"description": null,
"error": null,
"hide": 2,
"includeAll": false,
"label": "Datasource: Failure",
"multi": false,
"name": "datasourcefo",
"options": [],
"query": "elasticsearch",
"refresh": 1,
"regex": "/.*dmarc-fo/",
"skipUrlSync": false,
"type": "datasource"
},
{
"allValue": null,
"current": {
"selected": false,
"text": "All",
"value": "$__all"
},
"datasource": "$datasourceag",
"definition": "{\"find\":\"terms\",\"field\":\"header_from.keyword\"}",
"description": null,
"error": null,
"hide": 0,
"includeAll": true,
"label": "From Domain",
"multi": true,
"name": "fromdomain",
"options": [],
"query": "{\"find\":\"terms\",\"field\":\"header_from.keyword\"}",
"refresh": 2,
"regex": "",
"skipUrlSync": false,
"sort": 5,
"tagValuesQuery": "",
"tags": [],
"tagsQuery": "",
"type": "query",
"useTags": false
},
{
"auto": false,
"auto_count": 30,
"auto_min": "10s",
"current": {
"selected": false,
"text": "1d",
"value": "1d"
},
"description": null,
"error": null,
"hide": 2,
"label": "Interval",
"name": "interval",
"options": [
{
"selected": true,
"text": "1d",
"value": "1d"
}
],
"query": "1d",
"refresh": 2,
"skipUrlSync": false,
"type": "interval"
}
]
},
"time": {
"from": "now-30d",
"to": "now"
},
"timepicker": {
"hidden": false,
"refresh_intervals": [
"10s",
"30s",
"1m",
"5m",
"15m",
"30m",
"1h",
"2h",
"1d"
],
"time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
},
"timezone": "",
"title": "DMARC Reports",
"uid": "SDksirRWz",
"version": 114
}
Reference in new issue View Git Blame Copy Permalink