OPNsense & IDS/IPS
Dashboards to monitor Firewall Rules & IDS/IPS potential Attacks.
## Monitoring OPNsense with Loki
Prerequisites to monitor OPNsense Firewall- & IDS/IPS Logs with Loki:
- **Loadbalancer** to create virtual IP and to publish syslog ports (for example [MetalLB](https://metallb.universe.tf/))
- **Promtail or Grafana Agent** to listen on these ports and ship the logs to Loki
- **Loki** to index the logs
- **Grafana** to visualize the logs (datasource Loki configured)
- **OPNsense** syslog target configured

### Important!
The Grafana Dashboard only works when your OPNsense IDS/IPS logs has a label `job: syslog-ids` and all other Firewall logs has a label `job: syslog`.

Promtail Helm chart example values:
```yaml
config:
  lokiAddress: "http://loki-gateway/loki/api/v1/push"
  snippets:
    extraScrapeConfigs: |
      # Add an additional scrape config for syslog
      - job_name: syslog
        syslog:
          listen_address: 0.0.0.0:514
          idle_timeout: 60s
          label_structured_data: yes
          labels:
            job: "syslog"
        relabel_configs:
          - source_labels: ['__syslog_message_hostname']
            target_label: 'host'
      # Add an additional scrape config for OPNsense IDS alerts shipped over syslog
      - job_name: syslog-ids
        syslog:
          listen_address: 0.0.0.0:1514
          idle_timeout: 60s
          label_structured_data: yes
          labels:
            job: "syslog-ids"
        relabel_configs:
          - source_labels: ['__syslog_message_hostname']
            target_label: 'host'

extraPorts:
  # Add an additional port for syslog
  # serviceType "LoadBalancer" only works if you have deployed an Loadbalancer for example MetalLB
  syslog:
    name: tcp-syslog
    containerPort: 514
    protocol: TCP
    service:
      type: LoadBalancer
      #clusterIP: null
      port: 514
      #externalIPs: []
      #nodePort: 32682
      #annotations: {}
      #labels: {}
      #loadBalancerIP: null
      #loadBalancerSourceRanges: []
      #externalTrafficPolicy: null
  # Add an additional port for OPNsense IDS alerts shipped over syslog
  # serviceType "LoadBalancer" only works if you have deployed an Loadbalancer for example MetalLB
  syslog-ids:
    name: tcp-syslog-ids
    containerPort: 1514
    protocol: TCP
    service:
      type: LoadBalancer
      #clusterIP: null
      port: 1514
      #externalIPs: []
      #nodePort: 32682
      #annotations: {}
      #labels: {}
      #loadBalancerIP: null
      #loadBalancerSourceRanges: []
      #externalTrafficPolicy: null
```

{
  "__inputs": [
    {
      "name": "DS_LOKI",
      "label": "loki",
      "description": "OPNsense IDS/IPS logs must have label `job: syslog-ids` and all other Firewall logs must habe label `job: syslog`.",
      "type": "datasource",
      "pluginId": "loki",
      "pluginName": "Loki"
    }
  ],
  "__elements": {},
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "9.2.4"
    },
    {
      "type": "panel",
      "id": "logs",
      "name": "Logs",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "loki",
      "name": "Loki",
      "version": "1.0.0"
    },
    {
      "type": "panel",
      "id": "piechart",
      "name": "Pie chart",
      "version": ""
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "gridPos": {
        "h": 1,
        "w": 12,
        "x": 0,
        "y": 0
      },
      "id": 23,
      "options": {
        "dedupStrategy": "none",
        "enableLogDetails": true,
        "prettifyLogMessage": false,
        "showCommonLabels": false,
        "showLabels": false,
        "showTime": false,
        "sortOrder": "Descending",
        "wrapLogMessage": false
      },
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"syslog\", host=\"$host\"}\n|~ \"block|pass\" # filter to get only firewall logs\n!= \"icmp\" # filter only not ICMP packages\n| pattern `<_>,<_>,<_>,<RuleID>,<Interface>,<Reason>,<Action>,<Direction>,<IPVersion>,<_>,<_>,<TTL>,<ID>,<Offset>,<IPFlags>,<ProtocolNr>,<Protocol>,<Length>,<SourceIP>,<DestinationIP>,<SourcePort>,<DestinationPort>,<_>,<TCPFlags>,<Seq>,<_>,<_>`",
          "hide": false,
          "queryType": "range",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"syslog\", host=\"$host\"}\n|~ \"block|pass\" # filter to get only firewall logs\n|= \"icmp\" # filter only ICMP packages\n| pattern `<_>,<_>,<_>,<RuleID>,<Interface>,<Reason>,<Action>,<Direction>,<IPVersion>,<_>,<_>,<TTL>,<ID>,<Offset>,<IPFlags>,<ProtocolNr>,<Protocol>,<Length>,<SourceIP>,<DestinationIP>,<_>`",
          "hide": false,
          "queryType": "range",
          "refId": "B"
        }
      ],
      "title": "Firewall Base Search (do not delete)",
      "transformations": [],
      "type": "logs"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "gridPos": {
        "h": 1,
        "w": 12,
        "x": 12,
        "y": 0
      },
      "id": 20,
      "options": {
        "dedupStrategy": "none",
        "enableLogDetails": true,
        "prettifyLogMessage": false,
        "showCommonLabels": false,
        "showLabels": false,
        "showTime": false,
        "sortOrder": "Descending",
        "wrapLogMessage": false
      },
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"syslog-ids\",host=\"$host\"} != \"Drop\" |~ \"$searchregex\"\n|= \"Priority\" # filter to exclude not IDS/IPS events\n| pattern `[<_>:<ruleId>:<_>] <rule> [Classification: <classification>] [Priority: <priority>] {<protocol>} <sourceIP>:<sourcePort> -> <destinationIP>:<destinationPort>`\n| protocol!~\"IPv6.*\" ",
          "hide": false,
          "queryType": "range",
          "refId": "IPv4-NoDrop-Query"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"syslog-ids\",host=\"$host\"} |= \"Drop\" |~ \"$searchregex\"\n|= \"Priority\" # filter to exclude not IDS/IPS events\n| pattern `[<action>] [<_>:<ruleId>:<_>] <rule> [Classification: <classification>] [Priority: <priority>] {<protocol>} <sourceIP>:<sourcePort> -> <destinationIP>:<destinationPort>`\n| protocol!~\"IPv6.*\" ",
          "queryType": "range",
          "refId": "IPv4-Drop-Query"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"syslog-ids\",host=\"$host\"} != \"Drop\" |~ \"$searchregex\"\n|= \"Priority\" # filter to exclude not IDS/IPS events\n| pattern `[<action>] [<_>:<ruleId>:<_>] <rule> [Classification: <classification>] [Priority: <priority>] {<protocol>} <_>`\n| protocol=~\"IPv6.*\" # filter only IPv6 logs because pattern() cannot easy handle IPv6 that's why the following regex is used\n| regexp `(?P<sourceIP>(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))):(?P<sourcePort>\\d+) -> (?P<destinationIP>(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))):(?P<destinationPort>\\d+)`\n| label_format sourceIP=`{{ regexReplaceAllLiteral \"\\\\b(?:0+:){2,}\" .sourceIP \":\"}}`\n| label_format sourceIP=`{{ regexReplaceAllLiteral \"(:0+){1}\" .sourceIP \":\"}}`\n| label_format destinationIP=`{{ regexReplaceAllLiteral \"\\\\b(?:0+:){2,}\" .destinationIP \":\"}}`\n| label_format destinationIP=`{{ regexReplaceAllLiteral \"(:0+){1}\" .destinationIP \":\"}}`",
          "hide": false,
          "queryType": "range",
          "refId": "IPv6-NoDrop-Query"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"syslog-ids\",host=\"$host\"} |= \"Drop\" |~ \"$searchregex\"\n|= \"Priority\" # filter to exclude not IDS/IPS events\n| pattern `[<action>] [<_>:<ruleId>:<_>] <rule> [Classification: <classification>] [Priority: <priority>] {<protocol>} <_>`\n| protocol=~\"IPv6.*\" # filter only IPv6 logs because pattern() cannot easy handle IPv6 that's why the following regex is used\n| regexp `(?P<sourceIP>(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))):(?P<sourcePort>\\d+) -> (?P<destinationIP>(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))):(?P<destinationPort>\\d+)`\n| label_format sourceIP=`{{ regexReplaceAllLiteral \"\\\\b(?:0+:){2,}\" .sourceIP \":\"}}`\n| label_format sourceIP=`{{ regexReplaceAllLiteral \"(:0+){1}\" .sourceIP \":\"}}`\n| label_format destinationIP=`{{ regexReplaceAllLiteral \"\\\\b(?:0+:){2,}\" .destinationIP \":\"}}`\n| label_format destinationIP=`{{ regexReplaceAllLiteral \"(:0+){1}\" .destinationIP \":\"}}`",
          "hide": false,
          "queryType": "range",
          "refId": "IPv6-Drop-Query"
        }
      ],
      "title": "IDS Base Search (do not delete)",
      "transformations": [],
      "type": "logs"
    },
    {
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 1
      },
      "id": 27,
      "title": "Overview",
      "type": "row"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 12,
        "x": 0,
        "y": 2
      },
      "id": 13,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.2.4",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count_over_time({job=\"syslog\",host=\"$host\"}[$__range])",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Firewall Logs",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 12,
        "x": 12,
        "y": 2
      },
      "id": 19,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.2.4",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count_over_time({job=\"syslog-ids\", host=\"$host\"} |~ \"$searchregex\" [$__range])",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "IDS Events",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "block"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 0,
        "y": 6
      },
      "id": 21,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": true,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 23,
          "refId": "A"
        }
      ],
      "title": "Firewall Connections",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Action": {
                "aggregations": [],
                "operation": "groupby"
              },
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "destinationIP": {
                "aggregations": [],
                "operation": "groupby"
              },
              "sourceIP": {
                "aggregations": []
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "block"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 4,
        "y": 6
      },
      "id": 30,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": false,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 23,
          "refId": "A"
        }
      ],
      "title": "Firewall Connections",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "disabled": true,
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "Drop"
                  }
                },
                "fieldName": "action"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Action": {
                "aggregations": []
              },
              "Direction": {
                "aggregations": [],
                "operation": "groupby"
              },
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "destinationIP": {
                "aggregations": [],
                "operation": "groupby"
              },
              "sourceIP": {
                "aggregations": []
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "description": "Top 10 dropped inbound Firewall connections.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "block"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 8,
        "y": 6
      },
      "id": 31,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": false,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "limit": 10,
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 23,
          "refId": "A"
        }
      ],
      "title": "Firewall Connections by DestinationPort",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "in"
                  }
                },
                "fieldName": "Direction"
              },
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "block"
                  }
                },
                "fieldName": "Action"
              },
              {
                "config": {
                  "id": "isNotNull",
                  "options": {}
                },
                "fieldName": "DestinationPort"
              }
            ],
            "match": "all",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Action": {
                "aggregations": []
              },
              "DestinationPort": {
                "aggregations": [],
                "operation": "groupby"
              },
              "Direction": {
                "aggregations": []
              },
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "SourceIP": {
                "aggregations": []
              },
              "destinationIP": {
                "aggregations": [],
                "operation": "groupby"
              },
              "sourceIP": {
                "aggregations": []
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "Line (count)"
              }
            ]
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": [
            {
              "options": {
                "match": "empty",
                "result": {
                  "index": 0,
                  "text": "Allow"
                }
              },
              "type": "special"
            }
          ]
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Drop"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 12,
        "y": 6
      },
      "id": 24,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": false
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 20,
          "refId": "A"
        }
      ],
      "title": "Potential Attacks",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "disabled": true,
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "isNull",
                  "options": {}
                },
                "fieldName": "action"
              },
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "drop"
                  }
                },
                "fieldName": "action"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Count": {
                "aggregations": []
              },
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "action": {
                "aggregations": [],
                "operation": "groupby"
              },
              "destinationIP": {
                "aggregations": []
              },
              "sourceIP": {
                "aggregations": []
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "description": "Top 5 dropped potential attacks.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 16,
        "y": 6
      },
      "id": 8,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "list",
          "placement": "bottom",
          "showLegend": false
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "limit": 5,
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 20,
          "refId": "A"
        }
      ],
      "title": "Potential Attacks from",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "Drop"
                  }
                },
                "fieldName": "action"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "sourceIP": {
                "aggregations": [],
                "operation": "groupby"
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "Line (count)"
              }
            ]
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "description": "Top 10 dropped potential attacks by port.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 20,
        "y": 6
      },
      "id": 22,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "list",
          "placement": "bottom",
          "showLegend": false
        },
        "pieType": "pie",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "limit": 10,
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 20,
          "refId": "A"
        }
      ],
      "title": "Potential Attacks by DestinationPort",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "Drop"
                  }
                },
                "fieldName": "action"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "destinationIP": {
                "aggregations": []
              },
              "destinationPort": {
                "aggregations": [],
                "operation": "groupby"
              },
              "sourceIP": {
                "aggregations": []
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "Line (count)"
              }
            ]
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "description": "Dropped Inbound Firewall Connections",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "block"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 0,
        "y": 14
      },
      "id": 32,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": false,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 23,
          "refId": "A"
        }
      ],
      "title": "Firewall Connections by Protocol",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "in"
                  }
                },
                "fieldName": "Direction"
              }
            ],
            "match": "all",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Action": {
                "aggregations": []
              },
              "Direction": {
                "aggregations": []
              },
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "Protocol": {
                "aggregations": [],
                "operation": "groupby"
              },
              "SourceIP": {
                "aggregations": []
              },
              "destinationIP": {
                "aggregations": [],
                "operation": "groupby"
              },
              "sourceIP": {
                "aggregations": []
              },
              "sourcePort": {
                "aggregations": []
              }
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "continuous-BlPu"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Connections"
            },
            "properties": [
              {
                "id": "custom.displayMode",
                "value": "gradient-gauge"
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 4,
        "y": 14
      },
      "id": 33,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": true
        },
        "frameIndex": 0,
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "Connections"
          }
        ]
      },
      "pluginVersion": "9.2.4",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 23,
          "refId": "A"
        }
      ],
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "equal",
                  "options": {
                    "value": "in"
                  }
                },
                "fieldName": "Direction"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "SourceIP": {
                "aggregations": [],
                "operation": "groupby"
              },
              "classification": {
                "aggregations": [],
                "operation": "groupby"
              },
              "priority": {
                "aggregations": [],
                "operation": "groupby"
              }
            }
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {},
            "renameByName": {
              "Line (count)": "Connections",
              "classification": "Classification",
              "priority": "Priority"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 4,
        "x": 12,
        "y": 14
      },
      "id": 5,
      "options": {
        "displayLabels": [
          "name"
        ],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": true,
          "values": [
            "value"
          ]
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.1.7",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 20,
          "refId": "A"
        }
      ],
      "title": "Potential Attacks by Protocol",
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "isNotNull",
                  "options": {}
                },
                "fieldName": "priority"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Time": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "protocol": {
                "aggregations": [],
                "operation": "groupby"
              }
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "datasource",
        "uid": "-- Dashboard --"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "continuous-BlPu"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "Potential Attacks"
            },
            "properties": [
              {
                "id": "custom.displayMode",
                "value": "gradient-gauge"
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Priority"
            },
            "properties": [
              {
                "id": "custom.displayMode",
                "value": "color-text"
              },
              {
                "id": "mappings",
                "value": [
                  {
                    "options": {
                      "1": {
                        "color": "dark-red",
                        "index": 0
                      },
                      "2": {
                        "color": "dark-orange",
                        "index": 1
                      },
                      "3": {
                        "color": "yellow",
                        "index": 2
                      }
                    },
                    "type": "value"
                  }
                ]
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 8,
        "x": 16,
        "y": 14
      },
      "id": 10,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": true
        },
        "frameIndex": 0,
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "Potential Attacks"
          }
        ]
      },
      "pluginVersion": "9.2.4",
      "targets": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "panelId": 20,
          "refId": "A"
        }
      ],
      "transformations": [
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "extractFields",
          "options": {
            "format": "kvp",
            "replace": false,
            "source": "labels"
          }
        },
        {
          "id": "filterByValue",
          "options": {
            "filters": [
              {
                "config": {
                  "id": "isNotNull",
                  "options": {}
                },
                "fieldName": "classification"
              }
            ],
            "match": "any",
            "type": "include"
          }
        },
        {
          "id": "groupBy",
          "options": {
            "fields": {
              "Line": {
                "aggregations": [
                  "count"
                ],
                "operation": "aggregate"
              },
              "classification": {
                "aggregations": [],
                "operation": "groupby"
              },
              "priority": {
                "aggregations": [],
                "operation": "groupby"
              }
            }
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {},
            "indexByName": {},
            "renameByName": {
              "Line (count)": "Potential Attacks",
              "classification": "Classification",
              "priority": "Priority"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 22
      },
      "id": 29,
      "panels": [
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "description": "",
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "align": "auto",
                "displayMode": "auto",
                "filterable": true,
                "inspect": false
              },
              "mappings": [],
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  },
                  {
                    "color": "red",
                    "value": 80
                  }
                ]
              }
            },
            "overrides": [
              {
                "matcher": {
                  "id": "byName",
                  "options": "Action"
                },
                "properties": [
                  {
                    "id": "custom.displayMode",
                    "value": "color-background"
                  },
                  {
                    "id": "mappings",
                    "value": [
                      {
                        "options": {
                          "block": {
                            "color": "red",
                            "index": 1,
                            "text": "Block"
                          },
                          "pass": {
                            "color": "green",
                            "index": 0,
                            "text": "Pass"
                          }
                        },
                        "type": "value"
                      }
                    ]
                  }
                ]
              }
            ]
          },
          "gridPos": {
            "h": 20,
            "w": 12,
            "x": 0,
            "y": 23
          },
          "id": 25,
          "options": {
            "footer": {
              "fields": "",
              "reducer": [
                "sum"
              ],
              "show": false
            },
            "frameIndex": 0,
            "showHeader": true,
            "sortBy": [
              {
                "desc": true,
                "displayName": "Time"
              }
            ]
          },
          "pluginVersion": "9.1.7",
          "targets": [
            {
              "datasource": {
                "type": "datasource",
                "uid": "-- Dashboard --"
              },
              "panelId": 23,
              "refId": "A"
            }
          ],
          "title": "Firewall Logs",
          "transformations": [
            {
              "id": "merge",
              "options": {}
            },
            {
              "id": "extractFields",
              "options": {
                "format": "kvp",
                "replace": false,
                "source": "labels"
              }
            },
            {
              "id": "organize",
              "options": {
                "excludeByName": {
                  "ID": true,
                  "IPFlags": true,
                  "Length": true,
                  "Line": true,
                  "Offset": true,
                  "ProtocolNr": true,
                  "Reason": true,
                  "Seq": true,
                  "TCPFlags": true,
                  "TTL": true,
                  "host": true,
                  "id": true,
                  "job": true,
                  "labels": true,
                  "tsNs": true
                },
                "indexByName": {
                  "Action": 1,
                  "DestinationIP": 5,
                  "DestinationPort": 6,
                  "Direction": 2,
                  "ID": 11,
                  "IPFlags": 12,
                  "IPVersion": 13,
                  "Interface": 14,
                  "Length": 15,
                  "Line": 8,
                  "Offset": 16,
                  "Protocol": 17,
                  "ProtocolNr": 18,
                  "Reason": 19,
                  "RuleID": 20,
                  "Seq": 24,
                  "SourceIP": 3,
                  "SourcePort": 4,
                  "TCPFlags": 25,
                  "TTL": 21,
                  "Time": 0,
                  "host": 22,
                  "id": 10,
                  "job": 23,
                  "labels": 7,
                  "tsNs": 9
                },
                "renameByName": {
                  "id": ""
                }
              }
            }
          ],
          "type": "table"
        },
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "gridPos": {
            "h": 13,
            "w": 12,
            "x": 12,
            "y": 23
          },
          "id": 2,
          "options": {
            "dedupStrategy": "none",
            "enableLogDetails": true,
            "prettifyLogMessage": false,
            "showCommonLabels": false,
            "showLabels": false,
            "showTime": true,
            "sortOrder": "Descending",
            "wrapLogMessage": false
          },
          "targets": [
            {
              "datasource": {
                "type": "datasource",
                "uid": "-- Dashboard --"
              },
              "panelId": 20,
              "refId": "A"
            }
          ],
          "title": "Blocked by IDS/IPS Rules",
          "transformations": [
            {
              "id": "merge",
              "options": {}
            },
            {
              "id": "extractFields",
              "options": {
                "format": "kvp",
                "source": "labels"
              }
            },
            {
              "id": "filterByValue",
              "options": {
                "filters": [
                  {
                    "config": {
                      "id": "equal",
                      "options": {
                        "value": "Drop"
                      }
                    },
                    "fieldName": "action"
                  }
                ],
                "match": "all",
                "type": "include"
              }
            }
          ],
          "type": "logs"
        },
        {
          "datasource": {
            "type": "datasource",
            "uid": "-- Dashboard --"
          },
          "description": "",
          "gridPos": {
            "h": 7,
            "w": 12,
            "x": 12,
            "y": 36
          },
          "id": 9,
          "options": {
            "dedupStrategy": "none",
            "enableLogDetails": true,
            "prettifyLogMessage": false,
            "showCommonLabels": false,
            "showLabels": false,
            "showTime": true,
            "sortOrder": "Descending",
            "wrapLogMessage": false
          },
          "targets": [
            {
              "datasource": {
                "type": "datasource",
                "uid": "-- Dashboard --"
              },
              "panelId": 20,
              "refId": "A"
            }
          ],
          "title": "Allowed by IDS/IPS Rules",
          "transformations": [
            {
              "id": "merge",
              "options": {}
            },
            {
              "id": "extractFields",
              "options": {
                "format": "kvp",
                "source": "labels"
              }
            },
            {
              "id": "filterByValue",
              "options": {
                "filters": [
                  {
                    "config": {
                      "id": "notEqual",
                      "options": {
                        "value": "Drop"
                      }
                    },
                    "fieldName": "action"
                  }
                ],
                "match": "all",
                "type": "include"
              }
            }
          ],
          "type": "logs"
        }
      ],
      "title": "Detailed",
      "type": "row"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 23
      },
      "id": 15,
      "panels": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "description": "",
          "gridPos": {
            "h": 12,
            "w": 12,
            "x": 12,
            "y": 24
          },
          "id": 3,
          "options": {
            "dedupStrategy": "none",
            "enableLogDetails": true,
            "prettifyLogMessage": false,
            "showCommonLabels": false,
            "showLabels": false,
            "showTime": true,
            "sortOrder": "Descending",
            "wrapLogMessage": false
          },
          "targets": [
            {
              "datasource": {
                "type": "loki",
                "uid": "${DS_LOKI}"
              },
              "editorMode": "code",
              "expr": "{job=\"syslog-ids\",host=\"$host\"} \n|~ \"$searchregex\"\n!~ \"\\\\[\\\\d:\\\\d+:\\\\d\\\\]\"",
              "queryType": "range",
              "refId": "A"
            }
          ],
          "title": "Other IDS related Logs",
          "type": "logs"
        }
      ],
      "title": "Others",
      "type": "row"
    }
  ],
  "refresh": false,
  "schemaVersion": 37,
  "style": "dark",
  "tags": [
    "Security",
    "Firewall",
    "IDS/IPS",
    "OPNsense"
  ],
  "templating": {
    "list": [
      {
        "current": {},
        "datasource": {
          "type": "loki",
          "uid": "${DS_LOKI}"
        },
        "definition": "label_values({job=\"syslog-ids\"}, host)",
        "hide": 0,
        "includeAll": false,
        "label": "Host",
        "multi": false,
        "name": "host",
        "options": [],
        "query": "label_values({job=\"syslog-ids\"}, host)",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 1,
        "type": "query"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "hide": 0,
        "label": "Search-Regex",
        "name": "searchregex",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      }
    ]
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "OPNsense & IDS/IPS",
  "uid": "5aBjqZKVk",
  "version": 1,
  "weekStart": "",
  "gnetId": 17547,
  "description": "Dashboards to monitor Firewall Rules & IDS/IPS potential Attacks."
}