Torjus Håkestad
3e7aabc73a
Add gazetteer reference for country code lookup resolution. Remove unnecessary reduce transformation. Make geomap panel full-width (24 cols) and taller (h=10) on its own row. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
387 lines
10 KiB
JSON
387 lines
10 KiB
JSON
{
|
|
"uid": "apiary-homelab",
|
|
"title": "Apiary - Honeypot",
|
|
"tags": ["apiary", "honeypot", "prometheus", "homelab"],
|
|
"timezone": "browser",
|
|
"schemaVersion": 39,
|
|
"version": 1,
|
|
"refresh": "1m",
|
|
"time": {
|
|
"from": "now-24h",
|
|
"to": "now"
|
|
},
|
|
"templating": {
|
|
"list": []
|
|
},
|
|
"panels": [
|
|
{
|
|
"id": 1,
|
|
"title": "SSH Connections",
|
|
"type": "stat",
|
|
"gridPos": {"h": 4, "w": 6, "x": 0, "y": 0},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "sum(oubliette_ssh_connections_total{job=\"apiary\"})",
|
|
"legendFormat": "Total",
|
|
"refId": "A",
|
|
"instant": true
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{"color": "blue", "value": null}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"reduceOptions": {"calcs": ["lastNotNull"]},
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"description": "Total SSH connections across all outcomes"
|
|
},
|
|
{
|
|
"id": 2,
|
|
"title": "Active Sessions",
|
|
"type": "stat",
|
|
"gridPos": {"h": 4, "w": 6, "x": 6, "y": 0},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "oubliette_sessions_active{job=\"apiary\"}",
|
|
"legendFormat": "Active",
|
|
"refId": "A",
|
|
"instant": true
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{"color": "green", "value": null},
|
|
{"color": "yellow", "value": 5},
|
|
{"color": "red", "value": 20}
|
|
]
|
|
},
|
|
"noValue": "0"
|
|
}
|
|
},
|
|
"options": {
|
|
"reduceOptions": {"calcs": ["lastNotNull"]},
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"description": "Currently active honeypot sessions"
|
|
},
|
|
{
|
|
"id": 3,
|
|
"title": "Unique IPs",
|
|
"type": "stat",
|
|
"gridPos": {"h": 4, "w": 6, "x": 12, "y": 0},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "oubliette_storage_unique_ips{job=\"apiary\"}",
|
|
"legendFormat": "IPs",
|
|
"refId": "A",
|
|
"instant": true
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{"color": "purple", "value": null}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"reduceOptions": {"calcs": ["lastNotNull"]},
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"description": "Total unique source IPs observed"
|
|
},
|
|
{
|
|
"id": 4,
|
|
"title": "Total Login Attempts",
|
|
"type": "stat",
|
|
"gridPos": {"h": 4, "w": 6, "x": 18, "y": 0},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "oubliette_storage_login_attempts_total{job=\"apiary\"}",
|
|
"legendFormat": "Attempts",
|
|
"refId": "A",
|
|
"instant": true
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{"color": "orange", "value": null}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"reduceOptions": {"calcs": ["lastNotNull"]},
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"description": "Total login attempts stored"
|
|
},
|
|
{
|
|
"id": 5,
|
|
"title": "SSH Connections Over Time",
|
|
"type": "timeseries",
|
|
"gridPos": {"h": 8, "w": 12, "x": 0, "y": 4},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "rate(oubliette_ssh_connections_total{job=\"apiary\"}[$__rate_interval])",
|
|
"legendFormat": "{{outcome}}",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "cps",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"fillOpacity": 20,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"stacking": {"mode": "none"}
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"legend": {"displayMode": "list", "placement": "bottom"},
|
|
"tooltip": {"mode": "multi", "sort": "desc"}
|
|
},
|
|
"description": "SSH connection rate by outcome"
|
|
},
|
|
{
|
|
"id": 6,
|
|
"title": "Auth Attempts Over Time",
|
|
"type": "timeseries",
|
|
"gridPos": {"h": 8, "w": 12, "x": 12, "y": 4},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "rate(oubliette_auth_attempts_total{job=\"apiary\"}[$__rate_interval])",
|
|
"legendFormat": "{{reason}} - {{result}}",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "cps",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"fillOpacity": 20,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"stacking": {"mode": "none"}
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"legend": {"displayMode": "list", "placement": "bottom"},
|
|
"tooltip": {"mode": "multi", "sort": "desc"}
|
|
},
|
|
"description": "Authentication attempt rate by reason and result"
|
|
},
|
|
{
|
|
"id": 7,
|
|
"title": "Sessions by Shell",
|
|
"type": "timeseries",
|
|
"gridPos": {"h": 8, "w": 12, "x": 0, "y": 22},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "rate(oubliette_sessions_total{job=\"apiary\"}[$__rate_interval])",
|
|
"legendFormat": "{{shell}}",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "cps",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"fillOpacity": 20,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"stacking": {"mode": "normal"}
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"legend": {"displayMode": "list", "placement": "bottom"},
|
|
"tooltip": {"mode": "multi", "sort": "desc"}
|
|
},
|
|
"description": "Session creation rate by shell type"
|
|
},
|
|
{
|
|
"id": 8,
|
|
"title": "Attempts by Country",
|
|
"type": "geomap",
|
|
"gridPos": {"h": 10, "w": 24, "x": 0, "y": 12},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "oubliette_auth_attempts_by_country_total{job=\"apiary\"}",
|
|
"legendFormat": "{{country}}",
|
|
"refId": "A",
|
|
"instant": true,
|
|
"format": "table"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{"color": "green", "value": null},
|
|
{"color": "yellow", "value": 10},
|
|
{"color": "orange", "value": 50},
|
|
{"color": "red", "value": 200}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"view": {
|
|
"id": "zero",
|
|
"lat": 30,
|
|
"lon": 10,
|
|
"zoom": 2
|
|
},
|
|
"basemap": {
|
|
"type": "default"
|
|
},
|
|
"layers": [
|
|
{
|
|
"type": "markers",
|
|
"name": "Auth Attempts",
|
|
"config": {
|
|
"showLegend": true,
|
|
"style": {
|
|
"size": {
|
|
"field": "Value",
|
|
"min": 3,
|
|
"max": 20
|
|
},
|
|
"color": {
|
|
"field": "Value"
|
|
},
|
|
"symbol": {
|
|
"mode": "fixed",
|
|
"fixed": "img/icons/marker/circle.svg"
|
|
}
|
|
}
|
|
},
|
|
"location": {
|
|
"mode": "lookup",
|
|
"lookup": "country",
|
|
"gazetteer": "public/gazetteer/countries.json"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"description": "Authentication attempts by country (geo lookup from country code)"
|
|
},
|
|
{
|
|
"id": 9,
|
|
"title": "Session Duration Distribution",
|
|
"type": "heatmap",
|
|
"gridPos": {"h": 8, "w": 24, "x": 0, "y": 30},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "rate(oubliette_session_duration_seconds_bucket{job=\"apiary\"}[$__rate_interval])",
|
|
"legendFormat": "{{le}}",
|
|
"refId": "A",
|
|
"format": "heatmap"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"custom": {
|
|
"scaleDistribution": {
|
|
"type": "log",
|
|
"log": 2
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"calculate": false,
|
|
"yAxis": {
|
|
"unit": "s"
|
|
},
|
|
"color": {
|
|
"scheme": "Oranges",
|
|
"mode": "scheme"
|
|
},
|
|
"cellGap": 1,
|
|
"tooltip": {
|
|
"show": true
|
|
}
|
|
},
|
|
"description": "Distribution of session durations"
|
|
},
|
|
{
|
|
"id": 10,
|
|
"title": "Commands Executed by Shell",
|
|
"type": "timeseries",
|
|
"gridPos": {"h": 8, "w": 12, "x": 12, "y": 22},
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
"targets": [
|
|
{
|
|
"expr": "rate(oubliette_commands_executed_total{job=\"apiary\"}[$__rate_interval])",
|
|
"legendFormat": "{{shell}}",
|
|
"refId": "A"
|
|
}
|
|
],
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "cps",
|
|
"custom": {
|
|
"drawStyle": "line",
|
|
"lineInterpolation": "smooth",
|
|
"fillOpacity": 20,
|
|
"pointSize": 5,
|
|
"showPoints": "auto",
|
|
"stacking": {"mode": "normal"}
|
|
}
|
|
}
|
|
},
|
|
"options": {
|
|
"legend": {"displayMode": "list", "placement": "bottom"},
|
|
"tooltip": {"mode": "multi", "sort": "desc"}
|
|
},
|
|
"description": "Rate of commands executed in honeypot shells"
|
|
}
|
|
]
|
|
}
|