Grafana dashboard: Nextcloud Audit Logs
Description: Grafana dashboard for viewing Nextcloud audit logs with data collected by Loki/Promtail

Dashboard for Nextcloud audit logs. 

Features:
- Login monitoring
- Rights changes in user and file context
- Access monitoring of public shares
- Password changes

This dashboard uses Nextcloud audit logs, which must first be enabled in the Nextcloud configuration and is not compatible with the normal Nextcloud logs. 

Check out my [website](https://okxo.de/monitor-your-nextcloud-logs-for-suspicious-activities/) to see how to implement the dashboard.\
The source code is available on [Github](https://github.com/sowoi/grafana-nextcloud-audit-dashboard).


{
  "__inputs": [
    {
      "name": "DS_LOKI",
      "label": "Loki",
      "description": "",
      "type": "datasource",
      "pluginId": "loki",
      "pluginName": "Loki"
    }
  ],
  "__elements": {},
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "9.3.6"
    },
    {
      "type": "panel",
      "id": "logs",
      "name": "Logs",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "loki",
      "name": "Loki",
      "version": "1.0.0"
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    },
    {
      "type": "panel",
      "id": "timeseries",
      "name": "Time series",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "description": "Grafana dashboard for viewing Nextcloud audit logs with data collected by Loki/Promtail",
  "editable": true,
  "fiscalYearStartMonth": 0,
  "gnetId": 17987,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 16,
      "panels": [],
      "title": "Logins",
      "type": "row"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "this can also mean successful logins",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 12,
        "w": 6,
        "x": 0,
        "y": 1
      },
      "id": 20,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "sum by(remoteAddr) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~`/log.*`  message !~ `.*.(S|s)uccessful.*`  __error__=\"\"[$__range]))",
          "legendFormat": "{{ user }}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "login attempts by unique remote IP",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Anonymous users are scripts or talk logins",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [
            {
              "options": {
                "anonymous": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "value"
            },
            {
              "options": {
                "pattern": "anony.*",
                "result": {
                  "color": "red",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 12,
        "w": 6,
        "x": 6,
        "y": 1
      },
      "id": 23,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by(user) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json message=\"message\", remoteAddr=\"remoteAddr\", time=\"time\", userAgent=\"userAgent\", user=\"user\", url=\"url\" | message!~\".*(S|s)uccessful.*\"| __error__=\"\" [$__interval]))",
          "legendFormat": "{{ user }}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "login attempts by user",
      "transformations": [
        {
          "id": "renameByRegex",
          "options": {
            "regex": "--",
            "renamePattern": "anonymous"
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "This can also mean successful logins. If this value increases rapidly, it may be a DDOS attack.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "continuous-BlYlRd"
          },
          "custom": {
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 5,
            "gradientMode": "hue",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "smooth",
            "lineStyle": {
              "fill": "solid"
            },
            "lineWidth": 2,
            "pointSize": 5,
            "scaleDistribution": {
              "log": 2,
              "type": "symlog"
            },
            "showPoints": "always",
            "spanNulls": true,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 12,
        "w": 12,
        "x": 0,
        "y": 13
      },
      "id": 39,
      "options": {
        "legend": {
          "calcs": [
            "lastNotNull"
          ],
          "displayMode": "table",
          "placement": "right",
          "showLegend": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "asc"
        }
      },
      "pluginVersion": "9.2.8",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "sum by(remoteAddr) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~`/log.*`  message !~ `.*.(S|s)uccessful.*`  __error__=\"\"[$__range]))",
          "legendFormat": "{{ user }}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "login attempts by unique remote IP",
      "transformations": [
        {
          "id": "calculateField",
          "options": {}
        }
      ],
      "transparent": true,
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Attempted logins with invalid username or unsuccessful logins with known usernames. If a certain username appears more often than 1, it may be that the username was read out of eher via a databreach.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 12,
        "w": 12,
        "x": 0,
        "y": 25
      },
      "id": 33,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "value_and_name"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by(user)(sum by(user,reqId)(count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~`/login` | pattern `<_>Login attempt: \\\"<userLogin>\\\"` |  label_format user=userLogin| __error__=\"\"[$__range])) == 1)",
          "legendFormat": "{{ user }}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "login attempts with unknown user",
      "transformations": [
        {
          "id": "filterFieldsByName",
          "options": {
            "include": {
              "pattern": "^((?!Value).)*$"
            }
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "All logins",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "color-background",
            "inspect": false
          },
          "mappings": [
            {
              "options": {
                "pattern": "Login attempt.*",
                "result": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "Failed two factor attempt .*",
                "result": {
                  "color": "red",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "no user logins found within the the timerange",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 12,
        "w": 12,
        "x": 0,
        "y": 37
      },
      "id": 13,
      "options": {
        "footer": {
          "enablePagination": true,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | url=~`/log.*` | pattern `<_>Login attempt: \\\"<userName>\\\"` | pattern `<_>Login successful: \\\"<userName>\\\"` | pattern `<_>Failed two factor attempt by user <userName> `| pattern `<_>Successful two factor attempt by user <userName> ` | __error__=\"\"",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Logins",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "filename": true,
              "job": true,
              "level": true,
              "method": true,
              "reqId": true,
              "url": true,
              "user": true,
              "version": true
            },
            "indexByName": {
              "filename": 1,
              "job": 2,
              "message": 3,
              "remoteAddr": 5,
              "time": 0,
              "url": 6,
              "user": 7,
              "userAgent": 8,
              "userName": 4
            },
            "renameByName": {}
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "time"
              }
            ]
          }
        }
      ],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 49
      },
      "id": 18,
      "panels": [],
      "title": "User file interactions",
      "type": "row"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Changes made by registered users.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "color-background",
            "inspect": false
          },
          "mappings": [
            {
              "options": {
                "pattern": "DELETE.*",
                "result": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "Failed two factor attempt .*",
                "result": {
                  "color": "red",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "no file changes by users found within the the timerange",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 12,
        "x": 0,
        "y": 50
      },
      "id": 19,
      "options": {
        "footer": {
          "enablePagination": true,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"}| json | url=~\"/remote.php/dav/.*\" method!~\"REPORT\" method!~\"PROPFIND\" method!~\"OPTIONS\"  | pattern `<_>File<_> \\\"/<_>/<fileName>\\\"` | __error__=\"\"",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "File changes by authenticated users",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "filename": true,
              "job": true,
              "level": true,
              "reqId": true,
              "url": true,
              "user": false,
              "version": true
            },
            "indexByName": {
              "filename": 1,
              "job": 2,
              "message": 3,
              "remoteAddr": 5,
              "time": 0,
              "url": 6,
              "user": 7,
              "userAgent": 8,
              "userName": 4
            },
            "renameByName": {}
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "time"
              }
            ]
          }
        }
      ],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Files deleted from the trash bin. These are irretrievably deleted.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [
            {
              "options": {
                "pattern": "DELETE.*",
                "result": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "Failed two factor attempt .*",
                "result": {
                  "color": "red",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 2,
        "x": 0,
        "y": 63
      },
      "id": 25,
      "options": {
        "colorMode": "background",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by (message) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~\"/remote.php/dav/trashbin/.*\" method=\"DELETE\" | __error__=\"\" [$__interval]))",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Files deleted from trash",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "include": [],
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "If a lot of files were deleted at once, you should take a closer look.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [
            {
              "options": {
                "pattern": "DELETE.*",
                "result": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "Failed two factor attempt .*",
                "result": {
                  "color": "red",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 2,
        "x": 2,
        "y": 63
      },
      "id": 24,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by (message) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~\"/remote.php/dav/.*\" url!~\"/remote.php/dav/.*./trash\" method=\"DELETE\" | __error__=\"\" [$__interval]))",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Files deleted",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "include": [],
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "If a lot of files were changed at once, you should take a closer look.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "#EAB839",
                "value": 1
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 2,
        "x": 4,
        "y": 63
      },
      "id": 26,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {
          "valueSize": 0
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by (reqId) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~\"/apps/text/session/sync\" method=\"POST\" | __error__=\"\" [$__interval]))",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Files updated",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "include": [],
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Number of files created. If this number increases very much, there may be a problem.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [
            {
              "options": {
                "pattern": "DELETE.*",
                "result": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "Failed two factor attempt .*",
                "result": {
                  "color": "red",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 2,
        "x": 6,
        "y": 63
      },
      "id": 27,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by (message) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | message=~`File created.*` | __error__=\"\" [$__interval]))",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Files created",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "include": [],
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Number of downloads. These do not have to be different files.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 2,
        "x": 8,
        "y": 63
      },
      "id": 28,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by (message) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~\".*.download.*\"  | __error__=\"\" [$__interval]))",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "File downloads",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "include": [],
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Number of files created. If this number increases very much, there may be a problem.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 0,
            "gradientMode": "none",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "smooth",
            "lineWidth": 1,
            "pointSize": 5,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 7,
        "w": 12,
        "x": 0,
        "y": 68
      },
      "id": 38,
      "options": {
        "legend": {
          "calcs": [],
          "displayMode": "list",
          "placement": "bottom",
          "showLegend": true
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.2.8",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by (message) (count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | message=~`File created.*`| __error__=\"\" [$__range]))",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Files created",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "reducer": "sum"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "timeseries"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 75
      },
      "id": 10,
      "panels": [],
      "title": "User modifications",
      "type": "row"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "User changes, e.g. creation, deletion, deactivation, password change, etc.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "color-background",
            "inspect": false
          },
          "mappings": [
            {
              "options": {
                "pattern": "User.*.added to group \"admin\"",
                "result": {
                  "color": "red",
                  "index": 0,
                  "text": "User has been given admin rights"
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "User deleted.*",
                "result": {
                  "color": "yellow",
                  "index": 1,
                  "text": "User deleted"
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "no user changes found within the the timerange",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 11,
        "w": 12,
        "x": 0,
        "y": 76
      },
      "id": 12,
      "options": {
        "footer": {
          "enablePagination": true,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json  | url=~`/ocs/v2.php/cloud/users.*` | pattern `<_>User created: \\\"<userName>\\\"` | pattern `<_>User deleted: \\\"<userName>\\\"`| pattern `<_>Password of user \\\"<userName>\\\"` | pattern `<_>Email<_>user <userName>\"` | pattern `<_>User \\\"<userName>\\\" added` | pattern `<_>User \\\"<userName>\\\"` | pattern `<_>User enabled: \\\"<userName>\\\"` | pattern `<_>User disabled: \\\"<userName>\\\"`| __error__=\"\"",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Changes",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "filename": true,
              "job": true,
              "level": true,
              "method": true,
              "reqId": true,
              "url": true,
              "version": true
            },
            "indexByName": {
              "app": 9,
              "data_app": 10,
              "filename": 1,
              "job": 2,
              "level": 11,
              "message": 3,
              "method": 12,
              "remoteAddr": 7,
              "reqId": 13,
              "time": 0,
              "url": 4,
              "user": 6,
              "userAgent": 8,
              "userName": 5,
              "version": 14
            },
            "renameByName": {
              "user": "changedBy"
            }
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "time"
              }
            ]
          }
        }
      ],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 87
      },
      "id": 4,
      "panels": [],
      "title": "Shared Links",
      "type": "row"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Accesses without user login.",
      "fieldConfig": {
        "defaults": {
          "custom": {
            "align": "auto",
            "displayMode": "auto",
            "inspect": false
          },
          "mappings": [],
          "noValue": "no anonymous accesses found within the the timerange",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 11,
        "w": 12,
        "x": 0,
        "y": 88
      },
      "id": 1,
      "options": {
        "footer": {
          "enablePagination": true,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | user=`--` | message=~\"The shared.*\" | pattern `<_>The shared folder with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | pattern `<_>The shared file with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"`",
          "key": "Q-222bcf94-9244-4436-b368-330bbdc28fdd-0",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Anonymous accesses via share link",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "filename": true,
              "job": true,
              "level": true,
              "method": true,
              "reqId": true,
              "user": true,
              "version": true
            },
            "indexByName": {
              "accesstoken": 4,
              "app": 10,
              "data_app": 11,
              "filename": 1,
              "job": 2,
              "level": 12,
              "message": 3,
              "method": 13,
              "remoteAddr": 8,
              "reqId": 14,
              "sharedby": 5,
              "time": 0,
              "url": 6,
              "user": 7,
              "userAgent": 9,
              "version": 15
            },
            "renameByName": {}
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "time"
              }
            ]
          }
        }
      ],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "fieldConfig": {
        "defaults": {
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 11,
        "w": 4,
        "x": 0,
        "y": 99
      },
      "id": 29,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by(time)(count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | user=`--` message=~\"The shared.*\" | pattern `<_>The shared folder with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | pattern `<_>The shared file with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | __error__=\"\" [$__interval]))",
          "key": "Q-222bcf94-9244-4436-b368-330bbdc28fdd-0",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Anonymous accesses via share link (count)",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "fieldConfig": {
        "defaults": {
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 11,
        "w": 4,
        "x": 4,
        "y": 99
      },
      "id": 30,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "count by(remoteAddr)(count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | user=`--` message=~\"The shared.*\" | pattern `<_>The shared folder with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | pattern `<_>The shared file with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | __error__=\"\" [$__interval]))",
          "key": "Q-222bcf94-9244-4436-b368-330bbdc28fdd-0",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Anonymous accesses by unique remote IPs",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "reducer": "count"
            },
            "replaceFields": true
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "See permission changes panel below to find out if the full write permission has been revised again.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "noValue": "0",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          },
          "unit": "short"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 11,
        "w": 4,
        "x": 8,
        "y": 99
      },
      "id": 31,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "sum by(shareID)(count_over_time({job=\"$jobname\", filename=\"$filename\"} | json | url=~`/ocs/v2.php/apps/files_sharing/api/v1/shares/.*` message!~`The password.*` | pattern `<_>The permissions of the shared folder \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | changedPermissionID=`31` | __error__=\"\" [$__interval]))",
          "key": "Q-222bcf94-9244-4436-b368-330bbdc28fdd-0",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Possible folder shares with full write permission",
      "transformations": [
        {
          "id": "calculateField",
          "options": {
            "mode": "reduceRow",
            "reduce": {
              "reducer": "count"
            },
            "replaceFields": true
          }
        },
        {
          "disabled": true,
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "job": true,
              "level": true,
              "message": true,
              "method": true,
              "reqId": false,
              "userAgent": true,
              "version": true
            },
            "indexByName": {},
            "renameByName": {}
          }
        }
      ],
      "transparent": true,
      "type": "stat"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "Anonymous file operations via share link. Accesses without user login.",
      "fieldConfig": {
        "defaults": {
          "custom": {
            "align": "auto",
            "displayMode": "color-background",
            "filterable": true,
            "inspect": false
          },
          "mappings": [
            {
              "options": {
                "pattern": "File created.*",
                "result": {
                  "color": "red",
                  "index": 0
                }
              },
              "type": "regex"
            },
            {
              "options": {
                "pattern": "File written.*",
                "result": {
                  "color": "yellow",
                  "index": 1
                }
              },
              "type": "regex"
            }
          ],
          "noValue": "no anonymous file operations found within the the timerange",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "message"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 269
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 12,
        "x": 0,
        "y": 110
      },
      "id": 2,
      "options": {
        "footer": {
          "enablePagination": true,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"}| json  | user=`--` url!=`--` message!~`Login.*` | pattern `<_>File <_> \\\"/<_>/<fileName>\\\"` | pattern `<_>Preview <_> \\\"/<_>/<fileName>\\\"`| __error__=\"\"",
          "key": "Q-894d39f9-5739-404c-a219-de17a05259fb-0",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Anonymous file operations via sharelink",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "file_created": true,
              "file_deleted": true,
              "file_updated": true,
              "filename": true,
              "job": true,
              "level": true,
              "message": false,
              "method": true,
              "reqId": true,
              "url": true,
              "user": true,
              "version": true
            },
            "indexByName": {
              "app": 9,
              "data_app": 10,
              "fileName": 6,
              "filename": 1,
              "job": 2,
              "level": 11,
              "message": 3,
              "method": 12,
              "remoteAddr": 7,
              "reqId": 13,
              "time": 0,
              "url": 4,
              "user": 5,
              "userAgent": 8,
              "version": 14
            },
            "renameByName": {}
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "time"
              }
            ]
          }
        }
      ],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "#### Files\n| Share permissions | Code |\n| ------------------| ---|\n| Read-only |17 |\n| Allow editing | 19 |\n#### Folders\n| Share permissions | Code |\n| ------------------| ---|\n| Write Protected |17 |\n|Allow upload and editing | 31 |\n|Allow upload and editing (no upload) | 27 |\n|Allow upload and editing (no upload, no editing) |25 |",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "displayMode": "color-background",
            "inspect": false
          },
          "mappings": [
            {
              "options": {
                "4": {
                  "color": "green",
                  "index": 6,
                  "text": "drop files (upload only)"
                },
                "17": {
                  "color": "green",
                  "index": 0,
                  "text": "read-only"
                },
                "19": {
                  "color": "red",
                  "index": 1,
                  "text": "editable"
                },
                "21": {
                  "color": "yellow",
                  "index": 4,
                  "text": "upload"
                },
                "23": {
                  "color": "yellow",
                  "index": 7,
                  "text": "write permissions without delete"
                },
                "25": {
                  "color": "red",
                  "index": 5,
                  "text": "deletion rights"
                },
                "27": {
                  "color": "yellow",
                  "index": 2,
                  "text": "editable but no upload"
                },
                "31": {
                  "color": "red",
                  "index": 3,
                  "text": "full write permissoin"
                }
              },
              "type": "value"
            }
          ],
          "noValue": "no permission changes on shared folders found within the the timerange",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 11,
        "w": 12,
        "x": 0,
        "y": 121
      },
      "id": 6,
      "options": {
        "footer": {
          "enablePagination": true,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | url=~`/ocs/v2.php/apps/files_sharing/api/v1/shares/.*` message!~`The password.*`| pattern `<_>The permissions of the shared folder \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | pattern `<_>The permissions of the shared file \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | __error__=\"\"",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Permission changes on shared folders or files",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "format": "json",
            "replace": true,
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "app": true,
              "data_app": true,
              "filename": true,
              "job": true,
              "level": true,
              "method": true,
              "reqId": true,
              "url": true,
              "version": true
            },
            "indexByName": {
              "app": 11,
              "changedPermissionID": 7,
              "data_app": 12,
              "filename": 1,
              "job": 2,
              "level": 13,
              "message": 3,
              "method": 14,
              "remoteAddr": 4,
              "reqId": 15,
              "shareID": 8,
              "sharedFileOrFolder": 9,
              "time": 0,
              "url": 5,
              "user": 6,
              "userAgent": 10,
              "version": 16
            },
            "renameByName": {}
          }
        },
        {
          "id": "sortBy",
          "options": {
            "fields": {},
            "sort": [
              {
                "desc": true,
                "field": "time"
              }
            ]
          }
        }
      ],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 132
      },
      "id": 35,
      "panels": [],
      "title": "General log",
      "type": "row"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_LOKI}"
      },
      "description": "General nextcloud audit logs with references to events",
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 133
      },
      "id": 37,
      "options": {
        "dedupStrategy": "none",
        "enableLogDetails": true,
        "prettifyLogMessage": true,
        "showCommonLabels": false,
        "showLabels": false,
        "showTime": true,
        "sortOrder": "Descending",
        "wrapLogMessage": false
      },
      "pluginVersion": "9.2.8",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | message=~\"Login successful.*\" | line_format \"🟩 🌐 IP {{.remoteAddr}} 👥 {{.user}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "queryType": "range",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | url=~`/log.*`  message !~ `.*.(S|s)uccessful.*` | pattern `<_>. \\\"<wrongUser>\\\"` | line_format \"🟥 🌐 IP {{.remoteAddr}} 👥 {{.wrongUser}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "B"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"}| json | url=~\"/remote.php/dav/.*\" method!~\"REPORT\" method!~\"PROPFIND\" method!~\"OPTIONS\"  | pattern `<_>File<_> \\\"/<_>/<fileName>\\\"` | line_format \"🟩 🌐 IP {{.remoteAddr}} 👥 {{.user}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "C"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json  | url=~`/ocs/v2.php/cloud/users.*` | pattern `<_>User created: \\\"<userName>\\\"` | pattern `<_>User deleted: \\\"<userName>\\\"`| pattern `<_>Password of user \\\"<userName>\\\"` | pattern `<_>Email<_>user <userName>\"` | pattern `<_>User \\\"<userName>\\\" added` | pattern `<_>User \\\"<userName>\\\"` | pattern `<_>User enabled: \\\"<userName>\\\"` | pattern `<_>User disabled: \\\"<userName>\\\"`| line_format \"🟥 🌐 IP {{.remoteAddr}} 👥 {{.userName}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "D"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | user=`--` | message=~\"The shared.*\" | pattern `<_>The shared folder with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | pattern `<_>The shared file with the token \\\"<accesstoken>\\\" by \\\"<sharedby>\\\"` | line_format \"🟨 🌐 IP {{.remoteAddr}} 👥 anonymous 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "E"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | url=~`/ocs/v2.php/apps/files_sharing/api/v1/shares/.*` | message!~`The password.*`| pattern `<_>The permissions of the shared folder \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | pattern `<_>The permissions of the shared file \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | changedPermissionID=~`(19|25|31)`| line_format \"🟥 🌐 IP {{.remoteAddr}} 👥 {{.userName}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "F"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | url=~`/ocs/v2.php/apps/files_sharing/api/v1/shares/.*` | message!~`The password.*`| pattern `<_>The permissions of the shared folder \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | pattern `<_>The permissions of the shared file \\\"/<sharedFileOrFolder>\\\"<_>\\\"<shareID>\\\"<_>\\\"<changedPermissionID>\\\"` | changedPermissionID!~`(19|25|31)`| line_format \"🟩 🌐 IP {{.remoteAddr}} 👥 {{.userName}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "G"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_LOKI}"
          },
          "editorMode": "code",
          "expr": "{job=\"$jobname\", filename=\"$filename\"} | json | message=~\"Login successful.*\" | line_format \"🟩 🌐 IP {{.remoteAddr}} 👥 {{.user}} 🗩 {{.message }} 🖳 {{.userAgent}} {{.method}} {{.url }} {{.userAgent}}\"",
          "hide": false,
          "queryType": "range",
          "refId": "H"
        }
      ],
      "title": "logfile",
      "transparent": true,
      "type": "logs"
    }
  ],
  "refresh": "5s",
  "schemaVersion": 37,
  "style": "dark",
  "tags": [
    "nextcloud",
    "audit",
    "loki"
  ],
  "templating": {
    "list": [
      {
        "current": {
          "selected": false,
          "text": "Loki",
          "value": "Loki"
        },
        "hide": 0,
        "includeAll": false,
        "label": "Datasource",
        "multi": false,
        "name": "datasource",
        "options": [],
        "query": "loki",
        "queryValue": "",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "current": {},
        "datasource": {
          "type": "loki",
          "uid": "${DS_LOKI}"
        },
        "definition": "",
        "description": "name of nextcloud job",
        "hide": 0,
        "includeAll": false,
        "label": "",
        "multi": false,
        "name": "jobname",
        "options": [],
        "query": {
          "label": "job",
          "refId": "LokiVariableQueryEditor-VariableQuery",
          "stream": "",
          "type": 1
        },
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      },
      {
        "current": {},
        "datasource": {
          "type": "loki",
          "uid": "${DS_LOKI}"
        },
        "definition": "",
        "description": "logfile of nextcloud audit file",
        "hide": 0,
        "includeAll": false,
        "label": "nextcloudaudit",
        "multi": false,
        "name": "filename",
        "options": [],
        "query": {
          "label": "filename",
          "refId": "LokiVariableQueryEditor-VariableQuery",
          "stream": "",
          "type": 1
        },
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      }
    ]
  },
  "time": {
    "from": "now-3h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Nextcloud Audit Logs",
  "uid": "4wjPoyTVi",
  "version": 10,
  "weekStart": ""
}