Grafana dashboard: Akamai SIEM
Description: Akamai SIEM powered by Hydrolix dashboard for security analytics


Hydrolix dashboard for Akamai security events connector monitoring

{
  "__inputs": [
    {
      "name": "DS_HYDRO",
      "label": "Hydrolix Cluster",
      "description": "",
      "type": "datasource",
      "pluginId": "grafana-clickhouse-datasource",
      "pluginName": "ClickHouse"
    },
    {
      "name": "VAR_TABLE",
      "type": "constant",
      "label": "table",
      "value": "",
      "description": ""
    }
  ],
  "__elements": {},
  "__requires": [
    {
      "type": "panel",
      "id": "geomap",
      "name": "Geomap",
      "version": ""
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "9.5.1"
    },
    {
      "type": "datasource",
      "id": "grafana-clickhouse-datasource",
      "name": "ClickHouse",
      "version": "3.0.1-beta"
    },
    {
      "type": "panel",
      "id": "logs",
      "name": "Logs",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    },
    {
      "type": "panel",
      "id": "timeseries",
      "name": "Time series",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 0,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "linear",
            "lineWidth": 1,
            "pointSize": 5,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 0
      },
      "id": 1,
      "options": {
        "legend": {
          "calcs": [
            "sum",
            "max"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true,
          "sortBy": "Total",
          "sortDesc": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT arrayJoin(ruleActions) as ruleAction,\ncount(),\n$__timeInterval(timestamp) as time\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\n\n\nGROUP BY time, ruleAction\nORDER BY time",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "SIEM Logs Count",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 0,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "linear",
            "lineWidth": 1,
            "pointSize": 5,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 0
      },
      "id": 2,
      "options": {
        "legend": {
          "calcs": [
            "max",
            "sum"
          ],
          "displayMode": "table",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT toString(status) as status_code, count(),\n$__timeInterval(timestamp) as time\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY time, status_code\nORDER BY time",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "SIEM Logs per Status Code",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "count()"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "message"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 456
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "message"
            },
            "properties": [
              {
                "id": "links",
                "value": [
                  {
                    "title": "Filter",
                    "url": "/d/bd475a0d-b9b0-4577-8043-8a63aeb25e5e/akamai-siem?&var-message=${__data.fields[1]}&${__all_variables}&${__url_time_range}"
                  }
                ]
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "exclude"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 71
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 4,
        "x": 0,
        "y": 8
      },
      "id": 5,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT count(),\narrayJoin(ruleMessages) AS message\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY message\nORDER BY count() DESC\nLIMIT 100",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "Top 100 Message",
      "type": "table"
    },
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "count()"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "tags"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 456
              },
              {
                "id": "links",
                "value": [
                  {
                    "title": "Filter",
                    "url": "/d/bd475a0d-b9b0-4577-8043-8a63aeb25e5e/akamai-siem?var-tags=${__data.fields[1]}&${__all_variables}&${__url_time_range}"
                  }
                ]
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 5,
        "x": 4,
        "y": 8
      },
      "id": 8,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT count(),\narrayJoin(ruleTags) AS tags\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY tags\nORDER BY count() DESC\nLIMIT 100",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "Top 100 Tags",
      "type": "table"
    },
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "count()"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "path"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 731
              },
              {
                "id": "links",
                "value": [
                  {
                    "title": "Filter",
                    "url": "/d/bd475a0d-b9b0-4577-8043-8a63aeb25e5e/akamai-siem?var-path=${__data.fields[1]}&${__all_variables}&${__url_time_range}"
                  }
                ]
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 6,
        "x": 9,
        "y": 8
      },
      "id": 11,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT count(),\npath\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY path\nORDER BY count() DESC\nLIMIT 100",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "Top 100 Path",
      "type": "table"
    },
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "count()"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "clientIP"
            },
            "properties": [
              {
                "id": "links",
                "value": [
                  {
                    "title": "",
                    "url": "/d/bd475a0d-b9b0-4577-8043-8a63aeb25e5e/akamai-siem?&var-clientIP=${__data.fields[1]}&${__all_variables}&${__url_time_range}"
                  }
                ]
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 4,
        "x": 15,
        "y": 8
      },
      "id": 6,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT count(),\nclientIP\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY clientIP\nORDER BY count() DESC\nLIMIT 100",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "Top 100 Client IP",
      "type": "table"
    },
    {
      "datasource": {
        "type": "grafana-clickhouse-datasource",
        "uid": "${DS_HYDRO}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "count()"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 82
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "host"
            },
            "properties": [
              {
                "id": "links",
                "value": [
                  {
                    "title": "",
                    "url": "/d/bd475a0d-b9b0-4577-8043-8a63aeb25e5e/akamai-siem?&var-host=${__data.fields[1]}&${__all_variables}&${__url_time_range}"
                  }
                ]
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 5,
        "x": 19,
        "y": 8
      },
      "id": 10,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "expand": true,
          "format": 0,
          "meta": {
            "builderOptions": {
              "fields": [],
              "limit": 100,
              "mode": "list"
            }
          },
          "queryType": "sql",
          "rawSql": "SELECT count(),\nhost\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY host\nORDER BY count() DESC\nLIMIT 100",
          "refId": "A",
          "selectedFormat": 0
        }
      ],
      "title": "Top 100 Host",
      "type": "table"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 19
      },
      "id": 3,
      "panels": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "gridPos": {
            "h": 16,
            "w": 24,
            "x": 0,
            "y": 20
          },
          "id": 4,
          "options": {
            "dedupStrategy": "none",
            "enableLogDetails": true,
            "prettifyLogMessage": true,
            "showCommonLabels": false,
            "showLabels": false,
            "showTime": false,
            "sortOrder": "Descending",
            "wrapLogMessage": true
          },
          "targets": [
            {
              "datasource": {
                "type": "grafana-clickhouse-datasource",
                "uid": "${DS_HYDRO}"
              },
              "format": 2,
              "meta": {
                "builderOptions": {
                  "fields": [],
                  "limit": 100,
                  "mode": "list"
                }
              },
              "queryType": "sql",
              "rawSql": "SELECT ruleActions, * EXCEPT(ruleActions)\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nLIMIT 100",
              "refId": "A",
              "selectedFormat": 2
            }
          ],
          "title": "Raw Logs",
          "type": "logs"
        }
      ],
      "title": "Raw Logs",
      "type": "row"
    },
    {
      "collapsed": true,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 20
      },
      "id": 9,
      "panels": [
        {
          "datasource": {
            "type": "grafana-clickhouse-datasource",
            "uid": "${DS_HYDRO}"
          },
          "fieldConfig": {
            "defaults": {
              "color": {
                "mode": "thresholds"
              },
              "custom": {
                "hideFrom": {
                  "legend": false,
                  "tooltip": false,
                  "viz": false
                }
              },
              "mappings": [],
              "min": 0,
              "thresholds": {
                "mode": "absolute",
                "steps": [
                  {
                    "color": "green"
                  }
                ]
              },
              "unit": "short"
            },
            "overrides": []
          },
          "gridPos": {
            "h": 19,
            "w": 24,
            "x": 0,
            "y": 21
          },
          "id": 7,
          "options": {
            "basemap": {
              "config": {},
              "name": "Layer 0",
              "type": "default"
            },
            "controls": {
              "mouseWheelZoom": true,
              "showAttribution": true,
              "showDebug": false,
              "showMeasure": false,
              "showScale": false,
              "showZoom": true
            },
            "layers": [
              {
                "config": {
                  "blur": 15,
                  "radius": 10,
                  "weight": {
                    "fixed": 1,
                    "max": 1,
                    "min": 0
                  }
                },
                "filterData": {
                  "id": "byRefId",
                  "options": "A"
                },
                "location": {
                  "gazetteer": "public/gazetteer/countries.json",
                  "lookup": "country",
                  "mode": "lookup"
                },
                "name": "Layer 1",
                "opacity": 1,
                "tooltip": true,
                "type": "heatmap"
              }
            ],
            "tooltip": {
              "mode": "details"
            },
            "view": {
              "allLayers": true,
              "id": "zero",
              "lat": 0,
              "lon": 0,
              "zoom": 1
            }
          },
          "pluginVersion": "9.5.1",
          "targets": [
            {
              "datasource": {
                "type": "grafana-clickhouse-datasource",
                "uid": "${DS_HYDRO}"
              },
              "format": 1,
              "meta": {
                "builderOptions": {
                  "fields": [],
                  "limit": 100,
                  "mode": "list"
                }
              },
              "queryType": "sql",
              "rawSql": "SELECT country, count()\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nAND $__conditionalAll(host IN (${host}), $host)\nAND $__conditionalAll(method IN (${method}), $method)\nAND $__conditionalAll(status IN (${status}), $status)\nAND $__conditionalAll(country IN (${country}), $country)\nAND $__conditionalAll(clientIP IN (${clientIP}), $clientIP)\nAND $__conditionalAll(path IN (${path}), $path)\nAND $__conditionalAll(hasAll(ruleMessages, arrayPopBack([${message}])), $message)\nAND $__conditionalAll(hasAll(ruleTags, arrayPopBack([${tags}])), $tags)\nAND $__conditionalAll(has(ruleActions, '${ruleActions}'), $ruleActions)\nAND if ('${requestHeadersName:text}' = '', true, mapContainsKeyLike(requestHeaders, '%${requestHeadersName:text}%'))\nAND if ('${responseHeadersName:text}' = '', true, mapContainsKeyLike(responseHeaders, '%${responseHeadersName:text}%'))\nGROUP BY country",
              "refId": "A",
              "selectedFormat": 1
            }
          ],
          "title": "Geo Map",
          "type": "geomap"
        }
      ],
      "title": "Geo Map",
      "type": "row"
    }
  ],
  "refresh": "30s",
  "schemaVersion": 38,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "hide": 2,
        "name": "table",
        "query": "${VAR_TABLE}",
        "skipUrlSync": false,
        "type": "constant",
        "current": {
          "value": "${VAR_TABLE}",
          "text": "${VAR_TABLE}",
          "selected": false
        },
        "options": [
          {
            "value": "${VAR_TABLE}",
            "text": "${VAR_TABLE}",
            "selected": false
          }
        ]
      },
      {
        "current": {},
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "${DS_HYDRO}"
        },
        "definition": "SELECT host\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY host\nLIMIT 100",
        "hide": 0,
        "includeAll": true,
        "label": "Host",
        "multi": true,
        "name": "host",
        "options": [],
        "query": "SELECT host\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY host\nLIMIT 100",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {
          "selected": true,
          "text": "All",
          "value": "$__all"
        },
        "hide": 0,
        "includeAll": true,
        "label": "Rule Action",
        "multi": false,
        "name": "ruleActions",
        "options": [
          {
            "selected": true,
            "text": "All",
            "value": "$__all"
          },
          {
            "selected": false,
            "text": "monitor",
            "value": "monitor"
          },
          {
            "selected": false,
            "text": "alert",
            "value": "alert"
          },
          {
            "selected": false,
            "text": "allow",
            "value": "allow"
          },
          {
            "selected": false,
            "text": "tarpit",
            "value": "tarpit"
          }
        ],
        "query": "monitor, alert, allow, tarpit",
        "queryValue": "",
        "skipUrlSync": false,
        "type": "custom"
      },
      {
        "current": {},
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "${DS_HYDRO}"
        },
        "definition": "SELECT method\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY method\nLIMIT 100",
        "hide": 0,
        "includeAll": true,
        "label": "Method",
        "multi": true,
        "name": "method",
        "options": [],
        "query": "SELECT method\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY method\nLIMIT 100",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "${DS_HYDRO}"
        },
        "definition": "SELECT status\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY status\nLIMIT 100",
        "hide": 0,
        "includeAll": true,
        "label": "Status Code",
        "multi": true,
        "name": "status",
        "options": [],
        "query": "SELECT status\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY status\nLIMIT 100",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "grafana-clickhouse-datasource",
          "uid": "${DS_HYDRO}"
        },
        "definition": "SELECT country\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY country\nLIMIT 100",
        "hide": 0,
        "includeAll": true,
        "label": "Country",
        "multi": true,
        "name": "country",
        "options": [],
        "query": "SELECT country\nFROM ${table}\nWHERE $__timeFilter(timestamp)\nGROUP BY country\nLIMIT 100",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "hide": 0,
        "label": "Rule Message",
        "name": "message",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "hide": 0,
        "label": "Rule Tags",
        "name": "tags",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "hide": 0,
        "label": "Client IP",
        "name": "clientIP",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "hide": 0,
        "label": "Path",
        "name": "path",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "description": "For example look * request header name *",
        "hide": 0,
        "label": "requestHeaders Name",
        "name": "requestHeadersName",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      },
      {
        "current": {
          "selected": false,
          "text": "",
          "value": ""
        },
        "description": "For example look * response header name *",
        "hide": 0,
        "label": "responseHeaders Name",
        "name": "responseHeadersName",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "skipUrlSync": false,
        "type": "textbox"
      }
    ]
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Akamai SIEM",
  "uid": "bd475a0d-b9b0-4577-8043-8a63aeb25e5e",
  "version": 63,
  "weekStart": "",
  "gnetId": 18823,
  "description": "Akamai SIEM powered by Hydrolix dashboard for security analytics\r\n"
}