{
  "uid": "apiary-homelab",
  "title": "Apiary - Honeypot",
  "tags": ["apiary", "honeypot", "prometheus", "homelab"],
  "timezone": "browser",
  "schemaVersion": 39,
  "version": 1,
  "refresh": "1m",
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "templating": {
    "list": []
  },
  "panels": [
    {
      "id": 1,
      "title": "SSH Connections",
      "type": "stat",
      "gridPos": {"h": 4, "w": 6, "x": 0, "y": 0},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "sum(oubliette_ssh_connections_total{job=\"apiary\"})",
          "legendFormat": "Total",
          "refId": "A",
          "instant": true
        }
      ],
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {"color": "blue", "value": null}
            ]
          }
        }
      },
      "options": {
        "reduceOptions": {"calcs": ["lastNotNull"]},
        "colorMode": "value",
        "graphMode": "none",
        "textMode": "auto"
      },
      "description": "Total SSH connections across all outcomes"
    },
    {
      "id": 2,
      "title": "Active Sessions",
      "type": "stat",
      "gridPos": {"h": 4, "w": 6, "x": 6, "y": 0},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "oubliette_sessions_active{job=\"apiary\"}",
          "legendFormat": "Active",
          "refId": "A",
          "instant": true
        }
      ],
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {"color": "green", "value": null},
              {"color": "yellow", "value": 5},
              {"color": "red", "value": 20}
            ]
          },
          "noValue": "0"
        }
      },
      "options": {
        "reduceOptions": {"calcs": ["lastNotNull"]},
        "colorMode": "value",
        "graphMode": "none",
        "textMode": "auto"
      },
      "description": "Currently active honeypot sessions"
    },
    {
      "id": 3,
      "title": "Unique IPs",
      "type": "stat",
      "gridPos": {"h": 4, "w": 6, "x": 12, "y": 0},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "oubliette_storage_unique_ips{job=\"apiary\"}",
          "legendFormat": "IPs",
          "refId": "A",
          "instant": true
        }
      ],
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {"color": "purple", "value": null}
            ]
          }
        }
      },
      "options": {
        "reduceOptions": {"calcs": ["lastNotNull"]},
        "colorMode": "value",
        "graphMode": "none",
        "textMode": "auto"
      },
      "description": "Total unique source IPs observed"
    },
    {
      "id": 4,
      "title": "Total Login Attempts",
      "type": "stat",
      "gridPos": {"h": 4, "w": 6, "x": 18, "y": 0},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "oubliette_storage_login_attempts_total{job=\"apiary\"}",
          "legendFormat": "Attempts",
          "refId": "A",
          "instant": true
        }
      ],
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {"color": "orange", "value": null}
            ]
          }
        }
      },
      "options": {
        "reduceOptions": {"calcs": ["lastNotNull"]},
        "colorMode": "value",
        "graphMode": "none",
        "textMode": "auto"
      },
      "description": "Total login attempts stored"
    },
    {
      "id": 5,
      "title": "SSH Connections Over Time",
      "type": "timeseries",
      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 4},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "rate(oubliette_ssh_connections_total{job=\"apiary\"}[$__rate_interval])",
          "legendFormat": "{{outcome}}",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "cps",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "fillOpacity": 20,
            "pointSize": 5,
            "showPoints": "auto",
            "stacking": {"mode": "none"}
          }
        }
      },
      "options": {
        "legend": {"displayMode": "list", "placement": "bottom"},
        "tooltip": {"mode": "multi", "sort": "desc"}
      },
      "description": "SSH connection rate by outcome"
    },
    {
      "id": 6,
      "title": "Auth Attempts Over Time",
      "type": "timeseries",
      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 4},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "rate(oubliette_auth_attempts_total{job=\"apiary\"}[$__rate_interval])",
          "legendFormat": "{{reason}} - {{result}}",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "cps",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "fillOpacity": 20,
            "pointSize": 5,
            "showPoints": "auto",
            "stacking": {"mode": "none"}
          }
        }
      },
      "options": {
        "legend": {"displayMode": "list", "placement": "bottom"},
        "tooltip": {"mode": "multi", "sort": "desc"}
      },
      "description": "Authentication attempt rate by reason and result"
    },
    {
      "id": 7,
      "title": "Sessions by Shell",
      "type": "timeseries",
      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 22},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "rate(oubliette_sessions_total{job=\"apiary\"}[$__rate_interval])",
          "legendFormat": "{{shell}}",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "cps",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "fillOpacity": 20,
            "pointSize": 5,
            "showPoints": "auto",
            "stacking": {"mode": "normal"}
          }
        }
      },
      "options": {
        "legend": {"displayMode": "list", "placement": "bottom"},
        "tooltip": {"mode": "multi", "sort": "desc"}
      },
      "description": "Session creation rate by shell type"
    },
    {
      "id": 8,
      "title": "Attempts by Country",
      "type": "geomap",
      "gridPos": {"h": 10, "w": 24, "x": 0, "y": 12},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "oubliette_auth_attempts_by_country_total{job=\"apiary\"}",
          "legendFormat": "{{country}}",
          "refId": "A",
          "instant": true,
          "format": "table"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {"color": "green", "value": null},
              {"color": "yellow", "value": 10},
              {"color": "orange", "value": 50},
              {"color": "red", "value": 200}
            ]
          }
        }
      },
      "options": {
        "view": {
          "id": "zero",
          "lat": 30,
          "lon": 10,
          "zoom": 2
        },
        "basemap": {
          "type": "default"
        },
        "layers": [
          {
            "type": "markers",
            "name": "Auth Attempts",
            "config": {
              "showLegend": true,
              "style": {
                "size": {
                  "field": "Value",
                  "min": 3,
                  "max": 20
                },
                "color": {
                  "field": "Value"
                },
                "symbol": {
                  "mode": "fixed",
                  "fixed": "img/icons/marker/circle.svg"
                }
              }
            },
            "location": {
              "mode": "lookup",
              "lookup": "country",
              "gazetteer": "public/gazetteer/countries.json"
            }
          }
        ]
      },
      "description": "Authentication attempts by country (geo lookup from country code)"
    },
    {
      "id": 9,
      "title": "Session Duration Distribution",
      "type": "heatmap",
      "gridPos": {"h": 8, "w": 24, "x": 0, "y": 30},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "rate(oubliette_session_duration_seconds_bucket{job=\"apiary\"}[$__rate_interval])",
          "legendFormat": "{{le}}",
          "refId": "A",
          "format": "heatmap"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "custom": {
            "scaleDistribution": {
              "type": "log",
              "log": 2
            }
          }
        }
      },
      "options": {
        "calculate": false,
        "yAxis": {
          "unit": "s"
        },
        "color": {
          "scheme": "Oranges",
          "mode": "scheme"
        },
        "cellGap": 1,
        "tooltip": {
          "show": true
        }
      },
      "description": "Distribution of session durations"
    },
    {
      "id": 10,
      "title": "Commands Executed by Shell",
      "type": "timeseries",
      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 22},
      "datasource": {"type": "prometheus", "uid": "prometheus"},
      "targets": [
        {
          "expr": "rate(oubliette_commands_executed_total{job=\"apiary\"}[$__rate_interval])",
          "legendFormat": "{{shell}}",
          "refId": "A"
        }
      ],
      "fieldConfig": {
        "defaults": {
          "unit": "cps",
          "custom": {
            "drawStyle": "line",
            "lineInterpolation": "smooth",
            "fillOpacity": 20,
            "pointSize": 5,
            "showPoints": "auto",
            "stacking": {"mode": "normal"}
          }
        }
      },
      "options": {
        "legend": {"displayMode": "list", "placement": "bottom"},
        "tooltip": {"mode": "multi", "sort": "desc"}
      },
      "description": "Rate of commands executed in honeypot shells"
    }
  ]
}