From 361e7f2a1b1bd463055da0ce585d7182a4dafc2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= Date: Sun, 15 Feb 2026 21:31:06 +0100 Subject: [PATCH] grafana: add apiary honeypot dashboard Co-Authored-By: Claude Opus 4.6 --- services/grafana/dashboards/apiary.json | 393 ++++++++++++++++++++++++ 1 file changed, 393 insertions(+) create mode 100644 services/grafana/dashboards/apiary.json diff --git a/services/grafana/dashboards/apiary.json b/services/grafana/dashboards/apiary.json new file mode 100644 index 0000000..ccc5b30 --- /dev/null +++ b/services/grafana/dashboards/apiary.json @@ -0,0 +1,393 @@ +{ + "uid": "apiary-homelab", + "title": "Apiary - Honeypot", + "tags": ["apiary", "honeypot", "prometheus", "homelab"], + "timezone": "browser", + "schemaVersion": 39, + "version": 1, + "refresh": "1m", + "time": { + "from": "now-24h", + "to": "now" + }, + "templating": { + "list": [] + }, + "panels": [ + { + "id": 1, + "title": "SSH Connections", + "type": "stat", + "gridPos": {"h": 4, "w": 6, "x": 0, "y": 0}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "sum(oubliette_ssh_connections_total{job=\"apiary\"})", + "legendFormat": "Total", + "refId": "A", + "instant": true + } + ], + "fieldConfig": { + "defaults": { + "thresholds": { + "mode": "absolute", + "steps": [ + {"color": "blue", "value": null} + ] + } + } + }, + "options": { + "reduceOptions": {"calcs": ["lastNotNull"]}, + "colorMode": "value", + "graphMode": "none", + "textMode": "auto" + }, + "description": "Total SSH connections across all outcomes" + }, + { + "id": 2, + "title": "Active Sessions", + "type": "stat", + "gridPos": {"h": 4, "w": 6, "x": 6, "y": 0}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "oubliette_sessions_active{job=\"apiary\"}", + "legendFormat": "Active", + "refId": "A", + "instant": true + } + ], + "fieldConfig": { + "defaults": { + "thresholds": { + "mode": "absolute", + "steps": [ + {"color": "green", "value": null}, + {"color": "yellow", "value": 5}, + {"color": "red", "value": 20} + ] + }, + "noValue": "0" + } + }, + "options": { + "reduceOptions": {"calcs": ["lastNotNull"]}, + "colorMode": "value", + "graphMode": "none", + "textMode": "auto" + }, + "description": "Currently active honeypot sessions" + }, + { + "id": 3, + "title": "Unique IPs", + "type": "stat", + "gridPos": {"h": 4, "w": 6, "x": 12, "y": 0}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "oubliette_storage_unique_ips{job=\"apiary\"}", + "legendFormat": "IPs", + "refId": "A", + "instant": true + } + ], + "fieldConfig": { + "defaults": { + "thresholds": { + "mode": "absolute", + "steps": [ + {"color": "purple", "value": null} + ] + } + } + }, + "options": { + "reduceOptions": {"calcs": ["lastNotNull"]}, + "colorMode": "value", + "graphMode": "none", + "textMode": "auto" + }, + "description": "Total unique source IPs observed" + }, + { + "id": 4, + "title": "Total Login Attempts", + "type": "stat", + "gridPos": {"h": 4, "w": 6, "x": 18, "y": 0}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "oubliette_storage_login_attempts_total{job=\"apiary\"}", + "legendFormat": "Attempts", + "refId": "A", + "instant": true + } + ], + "fieldConfig": { + "defaults": { + "thresholds": { + "mode": "absolute", + "steps": [ + {"color": "orange", "value": null} + ] + } + } + }, + "options": { + "reduceOptions": {"calcs": ["lastNotNull"]}, + "colorMode": "value", + "graphMode": "none", + "textMode": "auto" + }, + "description": "Total login attempts stored" + }, + { + "id": 5, + "title": "SSH Connections Over Time", + "type": "timeseries", + "gridPos": {"h": 8, "w": 12, "x": 0, "y": 4}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "rate(oubliette_ssh_connections_total{job=\"apiary\"}[$__rate_interval])", + "legendFormat": "{{outcome}}", + "refId": "A" + } + ], + "fieldConfig": { + "defaults": { + "unit": "cps", + "custom": { + "drawStyle": "line", + "lineInterpolation": "smooth", + "fillOpacity": 20, + "pointSize": 5, + "showPoints": "auto", + "stacking": {"mode": "none"} + } + } + }, + "options": { + "legend": {"displayMode": "list", "placement": "bottom"}, + "tooltip": {"mode": "multi", "sort": "desc"} + }, + "description": "SSH connection rate by outcome" + }, + { + "id": 6, + "title": "Auth Attempts Over Time", + "type": "timeseries", + "gridPos": {"h": 8, "w": 12, "x": 12, "y": 4}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "rate(oubliette_auth_attempts_total{job=\"apiary\"}[$__rate_interval])", + "legendFormat": "{{reason}} - {{result}}", + "refId": "A" + } + ], + "fieldConfig": { + "defaults": { + "unit": "cps", + "custom": { + "drawStyle": "line", + "lineInterpolation": "smooth", + "fillOpacity": 20, + "pointSize": 5, + "showPoints": "auto", + "stacking": {"mode": "none"} + } + } + }, + "options": { + "legend": {"displayMode": "list", "placement": "bottom"}, + "tooltip": {"mode": "multi", "sort": "desc"} + }, + "description": "Authentication attempt rate by reason and result" + }, + { + "id": 7, + "title": "Sessions by Shell", + "type": "timeseries", + "gridPos": {"h": 8, "w": 12, "x": 0, "y": 12}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "rate(oubliette_sessions_total{job=\"apiary\"}[$__rate_interval])", + "legendFormat": "{{shell}}", + "refId": "A" + } + ], + "fieldConfig": { + "defaults": { + "unit": "cps", + "custom": { + "drawStyle": "line", + "lineInterpolation": "smooth", + "fillOpacity": 20, + "pointSize": 5, + "showPoints": "auto", + "stacking": {"mode": "normal"} + } + } + }, + "options": { + "legend": {"displayMode": "list", "placement": "bottom"}, + "tooltip": {"mode": "multi", "sort": "desc"} + }, + "description": "Session creation rate by shell type" + }, + { + "id": 8, + "title": "Attempts by Country", + "type": "geomap", + "gridPos": {"h": 8, "w": 12, "x": 12, "y": 12}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "oubliette_auth_attempts_by_country_total{job=\"apiary\"}", + "legendFormat": "{{country}}", + "refId": "A", + "instant": true, + "format": "table" + } + ], + "fieldConfig": { + "defaults": { + "thresholds": { + "mode": "absolute", + "steps": [ + {"color": "green", "value": null}, + {"color": "yellow", "value": 10}, + {"color": "orange", "value": 50}, + {"color": "red", "value": 200} + ] + } + } + }, + "options": { + "view": { + "id": "zero", + "lat": 30, + "lon": 10, + "zoom": 2 + }, + "basemap": { + "type": "default" + }, + "layers": [ + { + "type": "markers", + "name": "Auth Attempts", + "config": { + "showLegend": true, + "style": { + "size": { + "field": "Value", + "min": 3, + "max": 20 + }, + "color": { + "field": "Value" + }, + "symbol": { + "mode": "fixed", + "fixed": "img/icons/marker/circle.svg" + } + } + }, + "location": { + "mode": "lookup", + "lookup": "country" + } + } + ] + }, + "transformations": [ + { + "id": "reduce", + "options": { + "reducers": ["lastNotNull"] + } + } + ], + "description": "Authentication attempts by country (geo lookup from country code)" + }, + { + "id": 9, + "title": "Session Duration Distribution", + "type": "heatmap", + "gridPos": {"h": 8, "w": 12, "x": 0, "y": 20}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "rate(oubliette_session_duration_seconds_bucket{job=\"apiary\"}[$__rate_interval])", + "legendFormat": "{{le}}", + "refId": "A", + "format": "heatmap" + } + ], + "fieldConfig": { + "defaults": { + "custom": { + "scaleDistribution": { + "type": "log", + "log": 2 + } + } + } + }, + "options": { + "calculate": false, + "yAxis": { + "unit": "s" + }, + "color": { + "scheme": "Oranges", + "mode": "scheme" + }, + "cellGap": 1, + "tooltip": { + "show": true + } + }, + "description": "Distribution of session durations" + }, + { + "id": 10, + "title": "Commands Executed by Shell", + "type": "timeseries", + "gridPos": {"h": 8, "w": 12, "x": 12, "y": 20}, + "datasource": {"type": "prometheus", "uid": "prometheus"}, + "targets": [ + { + "expr": "rate(oubliette_commands_executed_total{job=\"apiary\"}[$__rate_interval])", + "legendFormat": "{{shell}}", + "refId": "A" + } + ], + "fieldConfig": { + "defaults": { + "unit": "cps", + "custom": { + "drawStyle": "line", + "lineInterpolation": "smooth", + "fillOpacity": 20, + "pointSize": 5, + "showPoints": "auto", + "stacking": {"mode": "normal"} + } + } + }, + "options": { + "legend": {"displayMode": "list", "placement": "bottom"}, + "tooltip": {"mode": "multi", "sort": "desc"} + }, + "description": "Rate of commands executed in honeypot shells" + } + ] +}