Grafana dashboard: Fleet DM
Description: Displays Data from the Fleet DM API and Query Result Log.


{
  "__inputs": [
    {
      "name": "DS_SHIFT-LOGS",
      "label": "shift-logs",
      "description": "",
      "type": "datasource",
      "pluginId": "loki",
      "pluginName": "Loki"
    }
  ],
  "__elements": {},
  "__requires": [
    {
      "type": "panel",
      "id": "bargauge",
      "name": "Bar gauge",
      "version": ""
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "9.5.1"
    },
    {
      "type": "panel",
      "id": "logs",
      "name": "Logs",
      "version": ""
    },
    {
      "type": "datasource",
      "id": "loki",
      "name": "Loki",
      "version": "1.0.0"
    },
    {
      "type": "panel",
      "id": "piechart",
      "name": "Pie chart",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    },
    {
      "type": "panel",
      "id": "text",
      "name": "Text",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "datasource": {
        "type": "datasource",
        "uid": "grafana"
      },
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 14,
      "options": {
        "code": {
          "language": "plaintext",
          "showLineNumbers": false,
          "showMiniMap": false
        },
        "content": "# Leave the interval at 1 hour for accurate CVE and Policy Counts",
        "mode": "markdown"
      },
      "pluginVersion": "9.5.1",
      "title": "Disclaimer",
      "type": "text"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 0,
        "y": 3
      },
      "id": 2,
      "options": {
        "displayLabels": [],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": true,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({path=\"/tmp/osquery_result\"} | logfmt [$__range])) by(decorations_hostname)",
          "legendFormat": "{{decorations_hostname}}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Queries Per Host",
      "transformations": [
        {
          "disabled": true,
          "id": "reduce",
          "options": {
            "labelsToFields": true,
            "reducers": [
              "lastNotNull"
            ]
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 6,
        "y": 3
      },
      "id": 5,
      "options": {
        "displayLabels": [],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": true,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({path=\"/tmp/osquery_result\"} | logfmt [$__range])) by(name)",
          "legendFormat": "{{decorations_hostname}}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Query Frequency",
      "transformations": [
        {
          "disabled": true,
          "id": "reduce",
          "options": {
            "labelsToFields": true,
            "reducers": [
              "lastNotNull"
            ]
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "decimals": 0,
          "mappings": [],
          "min": 0,
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 12,
        "y": 3
      },
      "id": 12,
      "options": {
        "displayMode": "lcd",
        "minVizHeight": 10,
        "minVizWidth": 0,
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "showUnfilled": true,
        "valueMode": "color"
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\"} |~ `status=fail`[1h]))",
          "legendFormat": "Fail",
          "queryType": "range",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\"} |~ `status=pass`[1h]))",
          "hide": false,
          "legendFormat": "Pass",
          "queryType": "range",
          "refId": "B"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\"} |~ `status=.*`[1h]))",
          "hide": false,
          "legendFormat": "Total",
          "queryType": "range",
          "refId": "C"
        }
      ],
      "title": "Policy Failure",
      "transformations": [
        {
          "id": "reduce",
          "options": {
            "reducers": [
              "lastNotNull"
            ]
          }
        }
      ],
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 18,
        "y": 3
      },
      "id": 3,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": []
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "builder",
          "expr": "{path=\"/tmp/osquery_result\"} | logfmt",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Hosts",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "source": "labels"
          }
        },
        {
          "id": "partitionByValues",
          "options": {
            "fields": [
              "decorations_hostname"
            ]
          }
        },
        {
          "id": "reduce",
          "options": {
            "includeTimeField": false,
            "mode": "reduceFields",
            "reducers": [
              "lastNotNull"
            ]
          }
        },
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "Line": true,
              "__name": true,
              "action": true,
              "counter": true,
              "decorations_host_uuid": true,
              "epoch": true,
              "host": true,
              "hostIdentifier": true,
              "id": true,
              "labels": true,
              "name": true,
              "numerics": true,
              "path": true,
              "snapshot_0_algorithm": true,
              "snapshot_0_comment": true,
              "snapshot_0_description": true,
              "snapshot_0_directory": true,
              "snapshot_0_gid": true,
              "snapshot_0_gid_signed": true,
              "snapshot_0_key": true,
              "snapshot_0_key_file": true,
              "snapshot_0_name": true,
              "snapshot_0_options": true,
              "snapshot_0_shell": true,
              "snapshot_0_uid": true,
              "snapshot_0_uid_signed": true,
              "snapshot_0_username": true,
              "snapshot_0_uuid": true,
              "snapshot_0_version": true,
              "tsNs": true,
              "unixTime": true
            },
            "indexByName": {
              "Line": 4,
              "__name": 7,
              "action": 8,
              "calendarTime": 0,
              "counter": 9,
              "decorations_host_uuid": 10,
              "decorations_hostname": 1,
              "epoch": 11,
              "host": 2,
              "hostIdentifier": 12,
              "id": 6,
              "labels": 3,
              "name": 13,
              "numerics": 14,
              "path": 15,
              "snapshot_0_algorithm": 16,
              "snapshot_0_comment": 17,
              "snapshot_0_description": 26,
              "snapshot_0_directory": 27,
              "snapshot_0_gid": 28,
              "snapshot_0_gid_signed": 29,
              "snapshot_0_key": 18,
              "snapshot_0_key_file": 19,
              "snapshot_0_name": 24,
              "snapshot_0_options": 20,
              "snapshot_0_shell": 30,
              "snapshot_0_uid": 21,
              "snapshot_0_uid_signed": 31,
              "snapshot_0_username": 22,
              "snapshot_0_uuid": 32,
              "snapshot_0_version": 25,
              "tsNs": 5,
              "unixTime": 23
            },
            "renameByName": {
              "calendarTime": "Last Query Time",
              "decorations_hostname": "Hostname"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 7,
        "w": 6,
        "x": 6,
        "y": 9
      },
      "id": 7,
      "options": {
        "displayLabels": [],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": true,
          "values": [
            "value",
            "percent"
          ]
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({path=\"/tmp/osquery_result\"} | logfmt |~ `snapshot_0_name=.*` [$__range])) by(snapshot_0_name)",
          "legendFormat": "{{decorations_hostname}}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Queries Per OS",
      "transformations": [
        {
          "disabled": true,
          "id": "reduce",
          "options": {
            "labelsToFields": true,
            "reducers": [
              "lastNotNull"
            ]
          }
        }
      ],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 0,
        "y": 16
      },
      "id": 8,
      "options": {
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "showLegend": true,
          "values": [
            "value"
          ]
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\"} |~ `cve=.*` | logfmt [1h])) by(cve)",
          "legendFormat": "{{decorations_hostname}}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "CVE Frequency",
      "transformations": [],
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 6,
        "y": 16
      },
      "id": 9,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "cve"
          }
        ]
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "{__name=\"fleet_import\",host=\"$host\"} |~ `cve=.*` | logfmt",
          "legendFormat": "{{cve}}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Host CVEs",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "Line": true,
              "Time": true,
              "__name": true,
              "host": true,
              "id": true,
              "labels": true,
              "tsNs": true
            },
            "indexByName": {
              "Line": 4,
              "Time": 3,
              "__name": 7,
              "cve": 0,
              "host": 8,
              "id": 6,
              "labels": 2,
              "packages": 1,
              "tsNs": 5
            },
            "renameByName": {}
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "auto",
            "cellOptions": {
              "type": "auto"
            },
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 12,
        "y": 16
      },
      "id": 10,
      "options": {
        "cellHeight": "sm",
        "footer": {
          "countRows": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "cve"
          }
        ]
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "{__name=\"fleet_import\",host=\"$host\"} |~ `policy=.*` | logfmt",
          "legendFormat": "{{policy}}",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Host Policies",
      "transformations": [
        {
          "id": "extractFields",
          "options": {
            "source": "labels"
          }
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "Line": true,
              "Time": true,
              "__name": true,
              "host": true,
              "id": true,
              "labels": true,
              "tsNs": true
            },
            "indexByName": {
              "Line": 4,
              "Time": 3,
              "__name": 7,
              "cve": 0,
              "host": 8,
              "id": 6,
              "labels": 2,
              "packages": 1,
              "tsNs": 5
            },
            "renameByName": {}
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "decimals": 0,
          "mappings": [],
          "min": 0,
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 13,
        "w": 6,
        "x": 18,
        "y": 16
      },
      "id": 11,
      "options": {
        "displayMode": "lcd",
        "minVizHeight": 10,
        "minVizWidth": 0,
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "showUnfilled": true,
        "valueMode": "color"
      },
      "pluginVersion": "9.5.1",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\",host=\"$host\"} |~ `status=fail`[1h]))",
          "legendFormat": "Fail",
          "queryType": "range",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\",host=\"$host\"} |~ `status=pass`[1h]))",
          "hide": false,
          "legendFormat": "Pass",
          "queryType": "range",
          "refId": "B"
        },
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "code",
          "expr": "sum(count_over_time({__name=\"fleet_import\",host=\"$host\"} |~ `status=.*`[1h]))",
          "hide": false,
          "legendFormat": "Total",
          "queryType": "range",
          "refId": "C"
        }
      ],
      "title": "Host Policy Info",
      "transformations": [
        {
          "id": "reduce",
          "options": {
            "reducers": [
              "lastNotNull"
            ]
          }
        }
      ],
      "type": "bargauge"
    },
    {
      "datasource": {
        "type": "loki",
        "uid": "${DS_SHIFT-LOGS}"
      },
      "gridPos": {
        "h": 14,
        "w": 24,
        "x": 0,
        "y": 29
      },
      "id": 4,
      "options": {
        "dedupStrategy": "none",
        "enableLogDetails": true,
        "prettifyLogMessage": false,
        "showCommonLabels": false,
        "showLabels": false,
        "showTime": false,
        "sortOrder": "Descending",
        "wrapLogMessage": false
      },
      "pluginVersion": "9.3.6",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "${DS_SHIFT-LOGS}"
          },
          "editorMode": "builder",
          "expr": "{path=\"/tmp/osquery_result\"} | logfmt",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "All Queries",
      "transformations": [],
      "type": "logs"
    }
  ],
  "refresh": "",
  "schemaVersion": 38,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "current": {
          "selected": false,
          "text": "shift-metrics",
          "value": "shift-metrics"
        },
        "hide": 0,
        "includeAll": false,
        "multi": false,
        "name": "Metrics",
        "options": [],
        "query": "prometheus",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "current": {
          "selected": false,
          "text": "shift-logs",
          "value": "shift-logs"
        },
        "hide": 0,
        "includeAll": false,
        "multi": false,
        "name": "Loki",
        "options": [],
        "query": "loki",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "current": {},
        "datasource": {
          "type": "loki",
          "uid": "${DS_SHIFT-LOGS}"
        },
        "definition": "",
        "hide": 0,
        "includeAll": false,
        "multi": false,
        "name": "host",
        "options": [],
        "query": {
          "label": "host",
          "refId": "LokiVariableQueryEditor-VariableQuery",
          "stream": "",
          "type": 1
        },
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query"
      }
    ]
  },
  "time": {
    "from": "now-1h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Fleet DM",
  "uid": "EF7rGtA6z",
  "version": 5,
  "weekStart": "",
  "gnetId": 18690,
  "description": "Displays Data from the Fleet DM API and Query Result Log."
}