Grafana dashboard: PFsense Firewall and IDS
Description: A pfSense dashboard that displays IDS (suricata) and Firewall events.  Uses Graylog as the backend.

This dashboard shows Firewall and IDS Events along with logs pulled from Graylog.  Designed to work with pfsense.
To setup pfsense and graylog, use this excellent write-up by Jake - 

https://jake.stride.me.uk/posts/2020/06/28/pfsense-suricata-and-snort-syslog-to-graylog.html

https://jake.stride.me.uk/posts/2020/07/04/pfsense-graylog-parsing.html

Additional note - these setup instructions have a few problems.  Barnyard2 is deprecated.  Using suricata, enable sending alerts to syslog.  This completely bypasses the need for Barnyard2.  I also recommend running your IDS on your LAN interface(s), and not your WAN interface(s).  This will give you better alerts (internal server being hit rather than the external IP) and reduce the alerts, because most packets are blocked by the firewall anyways.  No reason to scan packets that will be dropped by the firewall!

Please note:  You may need to tweak your elasticsearch install a bit - this dashboard allows you to drill down in firewall logs, which can have obscene numbers of different source and destination IP addresses.
Edit the elasticsearch.yml file (/etc/elasticsearch/elasticsearch.yml) and place this at the bottom:

indices.query.bool.max_clause_count: 10240

This will help in the event you want to select bunches of different IPs in the dropdowns, or if you have tons of WAN ip addresses.  Please note that the dropdowns have a maximum number they can display (1000) so all IPs in your log may not show up in the dropdown.  This is a grafana limitation.

If you have difficulties, hit me up on reddit: u/althornin

{
  "__inputs": [],
  "__requires": [
    {
      "type": "datasource",
      "id": "elasticsearch",
      "name": "Elasticsearch",
      "version": "1.0.0"
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "7.2.0"
    },
    {
      "type": "panel",
      "id": "grafana-piechart-panel",
      "name": "Pie Chart",
      "version": "1.5.0"
    },
    {
      "type": "panel",
      "id": "grafana-worldmap-panel",
      "name": "Worldmap Panel",
      "version": "0.3.2"
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table-old",
      "name": "Table (old)",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "description": "A pfSense dashboard that displays IDS (suricata) and Firewall events.  Uses Graylog as the backend.",
  "editable": true,
  "gnetId": 12637,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1601559671729,
  "links": [],
  "panels": [
    {
      "cacheTimeout": null,
      "datasource": "$filterlog_ds",
      "fieldConfig": {
        "defaults": {
          "custom": {},
          "mappings": [
            {
              "id": 0,
              "op": "=",
              "text": "N/A",
              "type": 1,
              "value": "null"
            }
          ],
          "nullValueMode": "connected",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "unit": "none"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 3,
        "w": 9,
        "x": 0,
        "y": 0
      },
      "id": 18,
      "interval": null,
      "links": [],
      "options": {
        "colorMode": "value",
        "fieldOptions": {
          "calcs": [
            "sum"
          ]
        },
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "7.2.0",
      "targets": [
        {
          "bucketAggs": [
            {
              "$$hashKey": "object:14",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "metrics": [
            {
              "$$hashKey": "object:12",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip AND dst_port:$dst_port",
          "refId": "A",
          "target": "",
          "timeField": "timestamp"
        }
      ],
      "timeFrom": null,
      "title": "Firewall Events on $iface",
      "type": "stat"
    },
    {
      "cacheTimeout": null,
      "datasource": "$filterlog_ds",
      "fieldConfig": {
        "defaults": {
          "custom": {},
          "mappings": [],
          "nullValueMode": "connected",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          },
          "unit": "none"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 9,
        "y": 0
      },
      "id": 8,
      "interval": null,
      "links": [],
      "maxDataPoints": 100,
      "options": {
        "colorMode": "value",
        "fieldOptions": {
          "calcs": [
            "first"
          ]
        },
        "graphMode": "none",
        "justifyMode": "center",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "first"
          ],
          "fields": "/^src_ip$/",
          "values": true
        },
        "textMode": "value"
      },
      "pluginVersion": "7.2.0",
      "targets": [
        {
          "bucketAggs": [
            {
              "$$hashKey": "object:120",
              "fake": true,
              "field": "src_ip",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "1"
              },
              "type": "terms"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:118",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "action:\"block\" AND interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip AND dst_port:$dst_port",
          "refId": "A",
          "target": "",
          "timeField": "timestamp"
        }
      ],
      "title": "Top IP Blocked by $iface",
      "transformations": [],
      "type": "stat"
    },
    {
      "cacheTimeout": null,
      "datasource": "$IDS_Datasource",
      "fieldConfig": {
        "defaults": {
          "custom": {},
          "mappings": [
            {
              "id": 0,
              "op": "=",
              "text": "N/A",
              "type": 1,
              "value": "null"
            }
          ],
          "nullValueMode": "connected",
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          },
          "unit": "none"
        },
        "overrides": []
      },
      "gridPos": {
        "h": 3,
        "w": 9,
        "x": 15,
        "y": 0
      },
      "id": 20,
      "interval": null,
      "links": [],
      "maxDataPoints": 100,
      "options": {
        "colorMode": "value",
        "fieldOptions": {
          "calcs": [
            "sum"
          ]
        },
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": [
            "sum"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "7.2.0",
      "targets": [
        {
          "bucketAggs": [
            {
              "$$hashKey": "object:5905",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:5903",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "application_name:suricata AND suricata_priority:([0 TO 9]) AND dst_port:$dst_port AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "IDS Events",
      "type": "stat"
    },
    {
      "circleMaxSize": "",
      "circleMinSize": "",
      "colors": [
        "#37872D",
        "#E0B400",
        "#C4162A",
        "#8F3BB8"
      ],
      "datasource": "$filterlog_ds",
      "decimals": 0,
      "esGeoPoint": "src_location",
      "esLocationName": "src_ip",
      "esMetric": "Count",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "gridPos": {
        "h": 10,
        "w": 9,
        "x": 0,
        "y": 3
      },
      "height": "",
      "hideEmpty": false,
      "hideZero": false,
      "id": 1,
      "initialZoom": "1",
      "links": [],
      "locationData": "countries",
      "mapCenter": "(0°, 0°)",
      "mapCenterLatitude": 0,
      "mapCenterLongitude": 0,
      "maxDataPoints": 1,
      "mouseWheelZoom": false,
      "showLegend": true,
      "stickyLabels": false,
      "tableQueryOptions": {
        "geohashField": "geohash",
        "latitudeField": "latitude",
        "longitudeField": "longitude",
        "metricField": "metric",
        "queryType": "geohash"
      },
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "$$hashKey": "object:974",
              "fake": true,
              "field": "src_ip_country_code",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "asc",
                "orderBy": "_count",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:975",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:972",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "thresholds": "10,100,500",
      "title": "Firewall Event Locations on $iface",
      "type": "grafana-worldmap-panel",
      "unitPlural": "",
      "unitSingle": "",
      "valueName": "total"
    },
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "$filterlog_ds",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "80%",
      "format": "none",
      "gridPos": {
        "h": 5,
        "w": 6,
        "x": 9,
        "y": 3
      },
      "id": 30,
      "interval": null,
      "legend": {
        "show": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 1,
      "nullPointMode": "connected",
      "pieType": "pie",
      "strokeWidth": 1,
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "$$hashKey": "object:1775",
              "fake": true,
              "field": "dst_port",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "5"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:1776",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:1773",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip AND dst_port:$dst_port AND action:\"block\"",
          "refId": "A",
          "target": "",
          "timeField": "timestamp"
        }
      ],
      "title": "Firewall Blocked Destination Ports on $iface",
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "circleMaxSize": "10",
      "circleMinSize": 2,
      "colors": [
        "#37872D",
        "rgba(237, 129, 40, 0.89)",
        "#C4162A",
        "#8F3BB8"
      ],
      "datasource": "$IDS_Datasource",
      "decimals": 0,
      "editable": true,
      "error": false,
      "esGeoPoint": "SrcGeoip.location",
      "esLocationName": "SrcGeoip.ip",
      "esMetric": "Count",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "gridPos": {
        "h": 10,
        "w": 9,
        "x": 15,
        "y": 3
      },
      "hideEmpty": false,
      "hideTimeOverride": false,
      "hideZero": false,
      "id": 22,
      "initialZoom": 1,
      "jsonUrl": "",
      "links": [],
      "locationData": "countries",
      "mapCenter": "(0°, 0°)",
      "mapCenterLatitude": 0,
      "mapCenterLongitude": 0,
      "maxDataPoints": 1,
      "mouseWheelZoom": false,
      "showLegend": true,
      "stickyLabels": false,
      "tableLabel": "DstGeo",
      "tableQueryOptions": {
        "geohashField": "geohash",
        "labelField": "src_addr_country_code",
        "latitudeField": "src_ip_latitude",
        "longitudeField": "src_ip_longitude",
        "metricField": "priority",
        "queryType": "coordinates"
      },
      "targets": [
        {
          "bucketAggs": [
            {
              "$$hashKey": "object:5154",
              "fake": true,
              "field": "src_ip_country_code",
              "id": "7",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:5155",
              "fake": true,
              "field": "timestamp",
              "id": "6",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:5152",
              "field": "ip",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "application_name:suricata AND suricata_priority:([0 TO 9]) AND dst_port:$dst_port AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "thresholds": "10,100,500",
      "timeFrom": null,
      "title": "IDS Event Locations",
      "type": "grafana-worldmap-panel",
      "unitPlural": "ips",
      "unitSingle": "",
      "unitSingular": "ip",
      "valueName": "total"
    },
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "$IDS_Datasource",
      "editable": true,
      "error": false,
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "60%",
      "format": "short",
      "gridPos": {
        "h": 5,
        "w": 6,
        "x": 9,
        "y": 8
      },
      "height": "250px",
      "id": 24,
      "interval": null,
      "legend": {
        "header": "",
        "show": true,
        "sideWidth": 200,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 1,
      "nullPointMode": "connected",
      "pieType": "donut",
      "strokeWidth": 1,
      "targets": [
        {
          "bucketAggs": [
            {
              "$$hashKey": "object:1933",
              "fake": true,
              "field": "dst_port",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "5"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:1934",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:1931",
              "field": "select field",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "application_name:suricata AND suricata_priority:([0 TO 9]) AND dst_port:$dst_port AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "title": "IDS Destination Ports",
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "$filterlog_ds",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "80%",
      "format": "none",
      "gridPos": {
        "h": 5,
        "w": 6,
        "x": 0,
        "y": 13
      },
      "id": 9,
      "interval": null,
      "legend": {
        "show": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 1,
      "nullPointMode": "connected",
      "pieType": "pie",
      "strokeWidth": 1,
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "$$hashKey": "object:1775",
              "fake": true,
              "field": "dst_port",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_count",
                "size": "5"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:1776",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:1773",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip AND dst_port:$dst_port AND action:\"pass\"",
          "refId": "A",
          "target": "",
          "timeField": "timestamp"
        }
      ],
      "title": "Firewall Passed Destination Ports on $iface",
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "$filterlog_ds",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "80%",
      "format": "none",
      "gridPos": {
        "h": 5,
        "w": 6,
        "x": 6,
        "y": 13
      },
      "id": 5,
      "interval": null,
      "legend": {
        "show": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 1,
      "nullPointMode": "connected",
      "pieType": "pie",
      "strokeWidth": 1,
      "targets": [
        {
          "bucketAggs": [
            {
              "$$hashKey": "object:1049",
              "fake": true,
              "field": "protocol",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "0"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:1050",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:1047",
              "field": "select field",
              "id": "1",
              "type": "count"
            }
          ],
          "query": "interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip AND dst_port:$dst_port",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "title": "Protocols On $iface",
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "aliasColors": {
        "Low - Detection of a Network Scan": "#96D98D",
        "Low - Generic Protocol Command Decode": "#C8F2C2",
        "Low - Not Suspicious Traffic": "#37872D",
        "Medium - Attempted Information Leak": "#FF780A",
        "Medium - Potentially Bad Traffic": "#E0B400"
      },
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "$IDS_Datasource",
      "editable": true,
      "error": false,
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "60%",
      "format": "short",
      "gridPos": {
        "h": 5,
        "w": 4,
        "x": 12,
        "y": 13
      },
      "height": "250px",
      "id": 29,
      "interval": "",
      "legend": {
        "header": "",
        "show": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 1,
      "nullPointMode": "connected",
      "pieType": "donut",
      "strokeWidth": 1,
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "$$hashKey": "object:5799",
              "fake": true,
              "field": "suricata_protocol",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "5"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:5800",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:5796",
              "field": "alert_description",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "application_name:suricata AND suricata_priority:([0 TO 9]) AND dst_port:$dst_port AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "timeFrom": null,
      "title": "IDS Protocols",
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "aliasColors": {
        "Low - Detection of a Network Scan": "#96D98D",
        "Low - Generic Protocol Command Decode": "#C8F2C2",
        "Low - Not Suspicious Traffic": "#37872D",
        "Medium - Attempted Information Leak": "#FF780A",
        "Medium - Potentially Bad Traffic": "#E0B400"
      },
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "$IDS_Datasource",
      "editable": true,
      "error": false,
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "60%",
      "format": "short",
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 16,
        "y": 13
      },
      "height": "250px",
      "id": 28,
      "interval": "",
      "legend": {
        "header": "",
        "show": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 1,
      "nullPointMode": "connected",
      "pieType": "donut",
      "strokeWidth": 1,
      "targets": [
        {
          "alias": "",
          "bucketAggs": [
            {
              "$$hashKey": "object:5798",
              "fake": true,
              "id": "4",
              "query": "*",
              "settings": {
                "filters": [
                  {
                    "$$hashKey": "object:5840",
                    "label": "Low -",
                    "query": "suricata_priority:3"
                  },
                  {
                    "$$hashKey": "object:5841",
                    "label": "Medium -",
                    "query": "suricata_priority:2"
                  },
                  {
                    "$$hashKey": "object:5842",
                    "label": "High -",
                    "query": "suricata_priority:1"
                  }
                ]
              },
              "type": "filters"
            },
            {
              "$$hashKey": "object:5799",
              "fake": true,
              "field": "suricata_classification",
              "id": "3",
              "settings": {
                "min_doc_count": 1,
                "order": "desc",
                "orderBy": "_term",
                "size": "5"
              },
              "type": "terms"
            },
            {
              "$$hashKey": "object:5800",
              "field": "timestamp",
              "id": "2",
              "settings": {
                "interval": "auto",
                "min_doc_count": 0,
                "trimEdges": 0
              },
              "type": "date_histogram"
            }
          ],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:5796",
              "field": "alert_description",
              "id": "1",
              "meta": {},
              "settings": {},
              "type": "count"
            }
          ],
          "query": "application_name:suricata AND suricata_priority:([0 TO 9]) AND dst_port:$dst_port AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "timeFrom": null,
      "title": "IDS Alerts by Type",
      "type": "grafana-piechart-panel",
      "valueName": "total"
    },
    {
      "columns": [
        {
          "$$hashKey": "object:1950",
          "text": "src_ip",
          "value": "src_ip"
        },
        {
          "$$hashKey": "object:2162",
          "text": "src_port",
          "value": "src_port"
        },
        {
          "$$hashKey": "object:2174",
          "text": "dst_ip",
          "value": "dst_ip"
        },
        {
          "$$hashKey": "object:2189",
          "text": "dst_port",
          "value": "dst_port"
        },
        {
          "$$hashKey": "object:990",
          "text": "protocol",
          "value": "protocol"
        },
        {
          "$$hashKey": "object:1117",
          "text": "action",
          "value": "action"
        },
        {
          "$$hashKey": "object:1144",
          "text": "timestamp",
          "value": "timestamp"
        },
        {
          "$$hashKey": "object:1302",
          "text": "rule_number",
          "value": "rule_number"
        }
      ],
      "datasource": "$filterlog_ds",
      "description": "",
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "filterNull": false,
      "fontSize": "80%",
      "gridPos": {
        "h": 12,
        "w": 12,
        "x": 0,
        "y": 18
      },
      "id": 14,
      "links": [],
      "pageSize": 5,
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": 5,
        "desc": true
      },
      "styles": [
        {
          "$$hashKey": "object:1963",
          "alias": "",
          "align": "auto",
          "dateFormat": "DD/MM/YY h:mm:ss a",
          "pattern": "src_port",
          "type": "string"
        },
        {
          "$$hashKey": "object:1964",
          "alias": "",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "pattern": "dst_port",
          "thresholds": [],
          "type": "string",
          "unit": "short"
        }
      ],
      "targets": [
        {
          "bucketAggs": [],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:1927",
              "field": "select field",
              "id": "1",
              "meta": {},
              "settings": {
                "size": 1000
              },
              "type": "raw_document"
            }
          ],
          "query": "interface:$iface AND src_ip:$src_ip AND dst_ip:$wan_ip AND dst_port:$dst_port",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "title": "Firewall Logs on $iface",
      "transform": "json",
      "transparent": true,
      "type": "table-old"
    },
    {
      "columns": [
        {
          "$$hashKey": "object:3049",
          "text": "timestamp",
          "value": "timestamp"
        },
        {
          "$$hashKey": "object:3118",
          "text": "src_ip",
          "value": "src_ip"
        },
        {
          "$$hashKey": "object:3365",
          "text": "suricata_classification",
          "value": "suricata_classification"
        },
        {
          "$$hashKey": "object:3548",
          "text": "suricata_message",
          "value": "suricata_message"
        },
        {
          "$$hashKey": "object:5126",
          "text": "src_ip_country_code",
          "value": "src_ip_country_code"
        },
        {
          "$$hashKey": "object:1937",
          "text": "suricata_priority",
          "value": "suricata_priority"
        }
      ],
      "datasource": "$IDS_Datasource",
      "editable": true,
      "error": false,
      "fieldConfig": {
        "defaults": {
          "custom": {}
        },
        "overrides": []
      },
      "fontSize": "80%",
      "gridPos": {
        "h": 12,
        "w": 12,
        "x": 12,
        "y": 18
      },
      "height": "300px",
      "id": 26,
      "links": [],
      "pageSize": 5,
      "scroll": true,
      "showHeader": true,
      "sort": {
        "col": 0,
        "desc": true
      },
      "styles": [
        {
          "$$hashKey": "object:3647",
          "alias": "Time",
          "align": "auto",
          "colorMode": null,
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "timestamp",
          "thresholds": [],
          "type": "date",
          "unit": "short"
        },
        {
          "$$hashKey": "object:3654",
          "alias": "Priority",
          "align": "auto",
          "colorMode": "row",
          "colors": [
            "rgba(245, 54, 54, 0.9)",
            "rgba(237, 129, 40, 0.89)",
            "rgba(50, 172, 45, 0.97)"
          ],
          "dateFormat": "YYYY-MM-DD HH:mm:ss",
          "decimals": 2,
          "mappingType": 1,
          "pattern": "suricata_priority",
          "thresholds": [
            "2",
            "3"
          ],
          "type": "string",
          "unit": "short",
          "valueMaps": [
            {
              "$$hashKey": "object:3798",
              "text": "High",
              "value": "1"
            },
            {
              "$$hashKey": "object:3799",
              "text": "Medium",
              "value": "2"
            },
            {
              "$$hashKey": "object:3800",
              "text": "Low",
              "value": "3"
            }
          ]
        }
      ],
      "targets": [
        {
          "alias": "",
          "bucketAggs": [],
          "dsType": "elasticsearch",
          "metrics": [
            {
              "$$hashKey": "object:3036",
              "field": "select field",
              "id": "1",
              "meta": {},
              "settings": {
                "size": 500
              },
              "type": "raw_document"
            }
          ],
          "query": "application_name:suricata AND suricata_priority:([0 TO 9]) AND dst_port:$dst_port AND src_ip:$src_ip AND dst_ip:$wan_ip",
          "refId": "A",
          "timeField": "timestamp"
        }
      ],
      "title": "IDS Alert Log",
      "transform": "json",
      "transparent": true,
      "type": "table-old"
    }
  ],
  "refresh": "1m",
  "schemaVersion": 26,
  "style": "dark",
  "tags": [
    "Elasticsearch",
    "Firewall",
    "Log Analyzer",
    "PFsense",
    "Graylog"
  ],
  "templating": {
    "list": [
      {
        "current": {
          "selected": false,
          "text": "Graylog_Pfsense_filterlog",
          "value": "Graylog_Pfsense_filterlog"
        },
        "hide": 0,
        "includeAll": false,
        "label": "Filterlog Datasource",
        "multi": false,
        "name": "filterlog_ds",
        "options": [],
        "query": "elasticsearch",
        "queryValue": "",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "current": {
          "selected": false,
          "text": "Graylog_Suricata",
          "value": "Graylog_Suricata"
        },
        "hide": 0,
        "includeAll": false,
        "label": "IDS Datasource",
        "multi": false,
        "name": "IDS_Datasource",
        "options": [],
        "query": "elasticsearch",
        "queryValue": "",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$filterlog_ds",
        "definition": "{\"find\": \"terms\", \"field\":\"interface\",\"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "hide": 0,
        "includeAll": false,
        "label": "Interface",
        "multi": false,
        "name": "iface",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\":\"interface\",\"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": "*",
        "current": {},
        "datasource": "$filterlog_ds",
        "definition": "{\"find\": \"terms\", \"field\":\"dst_ip\",\"query\":\"interface:$iface\",\"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "hide": 0,
        "includeAll": true,
        "label": "Destination IP",
        "multi": true,
        "name": "wan_ip",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\":\"dst_ip\",\"query\":\"interface:$iface\",\"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": "*",
        "current": {},
        "datasource": "$filterlog_ds",
        "definition": "{\"find\": \"terms\", \"field\": \"src_ip\", \"query\": \"dst_ip:$wan_ip interface:$iface\", \"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "hide": 0,
        "includeAll": true,
        "label": "Source IP",
        "multi": true,
        "name": "src_ip",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"src_ip\", \"query\": \"dst_ip:$wan_ip interface:$iface\", \"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": "*",
        "current": {},
        "datasource": "$filterlog_ds",
        "definition": "{\"find\": \"terms\", \"field\": \"dst_port\", \"query\": \"dst_ip:$wan_ip interface:$iface\", \"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "hide": 0,
        "includeAll": true,
        "label": "Destination Port",
        "multi": true,
        "name": "dst_port",
        "options": [],
        "query": "{\"find\": \"terms\", \"field\": \"dst_port\", \"query\": \"dst_ip:$wan_ip interface:$iface\", \"timestamp\": {\n\"gte\" : \"now-$__Interval_ms\"\n}}",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 3,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "datasource": "$IDS_Datasource",
        "filters": [],
        "hide": 0,
        "label": "",
        "name": "Filters",
        "skipUrlSync": false,
        "type": "adhoc"
      }
    ]
  },
  "time": {
    "from": "now-3h",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "browser",
  "title": "PFsense Firewall and IDS",
  "uid": "000000030",
  "version": 38
}