Grafana dashboard: Grafana Dashboard for User Audit VB365
Description: Grafana Dashboard for User Audit for Restore Portal of Veeam Backup for Microsoft 365

Just download the latest required script version from GitHub [https://raw.githubusercontent.com/jorgedlcruz/veeam-backup-restore-portal-audit/main/veeam_microsoft365_audit.sh](https://raw.githubusercontent.com/jorgedlcruz/veeam-backup-restore-portal-audit/main/veeam_microsoft365_audit.sh) and change the Configuration section within your details:

```
##
# Configurations
##
# Endpoint URL for InfluxDB
veeamInfluxDBURL="http://YOURINFLUXSERVERIP" #Your InfluxDB Server, http://FQDN or https://FQDN if using SSL
veeamInfluxDBPort="8086" #Default Port
veeamInfluxDBBucket="veeam" # InfluxDB bucket name (not ID)
veeamInfluxDBToken="TOKEN" # InfluxDB access token with read/write privileges for the bucket
veeamInfluxDBOrg="ORG NAME" # InfluxDB organisation name (not ID)

# Endpoint Configuration for Azure AD
ApplicationID="YOURAPPLICATIONID" # You can find these on your VB365 Server, on the Restore Portal, or in Azure
TenatDomainName="YOURTENANTDOMAINNAME" # Easy to find this on the next URL - https://portal.azure.com/#blade/Microsoft_AAD_IAM/TenantPropertiesBlade
AccessSecret="YOURACCESSSECRET" # Create a new Client secret under your Veeam Restore Portal App registrations in Azure
``` 
Once the changes are done, make the script executable with chmod:
```
chmod +x veeam_microsoft365_audit.sh
``` 
The output of the command should be something like the next, without errors:
```
Writing veeam_microsoft365_auditPolicy to InfluxDB
HTTP/2 204 
x-influxdb-build: OSS
x-influxdb-version: 2.1.1
date: Wed, 15 Dec 2021 16:14:56 GMT
``` 
If so, please now add this script to your crontab, like for example every 30 minutes:
```
*/30 * * * * /home/oper/veeam_microsoft365_audit.sh >> /var/log/veeam_microsoft365_audit.log 2>&1
``` 

Then download or import this Dashboard to your Grafana, and you should see something similar to the next:
![alt tag](https://jorgedelacruz.uk/wp-content/uploads/2022/03/veeam-microsoft-365-audit-001.jpg)

{
  "__inputs": [
    {
      "name": "DS_INFLUXDB",
      "label": "InfluxDB",
      "description": "",
      "type": "datasource",
      "pluginId": "influxdb",
      "pluginName": "InfluxDB"
    }
  ],
  "__elements": [],
  "__requires": [
    {
      "type": "panel",
      "id": "geomap",
      "name": "Geomap",
      "version": ""
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "8.3.3"
    },
    {
      "type": "datasource",
      "id": "influxdb",
      "name": "InfluxDB",
      "version": "1.0.0"
    },
    {
      "type": "panel",
      "id": "piechart",
      "name": "Pie chart",
      "version": ""
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "description": "Grafana Dashboard for User Audit for Restore Portal of Veeam Backup for Microsoft 365",
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1648542898997,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "description": "On this Map, you can quickly know which End-Users, Tenants, or Restore Operators have logged in into the Restore Portal, from where, IP Address, Web Browser, and Operating System.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "percentage",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 15,
        "w": 18,
        "x": 0,
        "y": 0
      },
      "id": 2,
      "options": {
        "basemap": {
          "config": {},
          "name": "Layer 0",
          "type": "default"
        },
        "controls": {
          "mouseWheelZoom": true,
          "showAttribution": false,
          "showDebug": false,
          "showScale": false,
          "showZoom": true
        },
        "layers": [
          {
            "config": {
              "showLegend": true,
              "style": {
                "color": {
                  "fixed": "dark-orange"
                },
                "opacity": 0.5,
                "rotation": {
                  "fixed": 0,
                  "max": 360,
                  "min": -360,
                  "mode": "mod"
                },
                "size": {
                  "fixed": 6,
                  "max": 15,
                  "min": 2
                },
                "symbol": {
                  "fixed": "img/icons/marker/circle.svg",
                  "mode": "fixed"
                },
                "text": {
                  "mode": "field"
                },
                "textConfig": {
                  "fontSize": 12,
                  "offsetX": 0,
                  "offsetY": 0,
                  "textAlign": "right",
                  "textBaseline": "middle"
                }
              }
            },
            "location": {
              "latitude": "Latitude",
              "longitude": "Longitude",
              "mode": "coords"
            },
            "name": "Layer 1",
            "type": "markers"
          }
        ],
        "view": {
          "id": "coords",
          "lat": 43.663091,
          "lon": -27.278944,
          "shared": false,
          "zoom": 3.86
        }
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> filter(fn: (r) => r[\"_field\"] == \"veeamVBMRPLoginLocationCityGEOLAT\" or r[\"_field\"] == \"veeamVBMRPLoginLocationCityGEOLONG\")\r\n  |> filter(fn: (r) => r[\"veeamVBMRPAppID\"] =~ /${RestorePortalID:regex}/)\r\n  |> filter(fn: (r) => r[\"veeamVBMRPLoginDevice\"] =~ /${RestorePortalUserDevice:regex}/)\r\n  |> filter(fn: (r) => r[\"veeamVBMRPLoginBrowser\"] =~ /${RestorePortalUserBrowser:regex}/)\r\n    |> filter(fn: (r) => r[\"veeamVBMRPUserPN\"] =~ /${RestorePortalUser:regex}/)\r\n  |> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)\r\n  |> yield(name: \"mean\")",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "hide": false,
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> filter(fn: (r) => r[\"_field\"] == \"veeamVBMRPLoginLocationCityGEOLAT\")\r\n  |> filter(fn: (r) => r[\"veeamVBMRPAppID\"] =~ /${RestorePortalID:regex}/)\r\n  |> group(columns: [\"veeamVBMRPUserDN\"])\r\n  |> count()\r\n  |> yield(name: \"count\")",
          "refId": "B"
        }
      ],
      "title": "Veeam Restore Portal - Activity Details Audit World Map",
      "transformations": [
        {
          "id": "labelsToFields",
          "options": {}
        },
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "_field": true,
              "_start": true,
              "_stop": true,
              "veeamVBMRPAppDN": true,
              "veeamVBMRPAppID": true,
              "veeamVBMRPLoginAppUsed": true,
              "veeamVBMRPLoginFailureReason": true,
              "veeamVBMRPLoginID": true,
              "veeamVBMRPLoginLocationCity": true,
              "veeamVBMRPLoginLocationCountry": true,
              "veeamVBMRPLoginLocationState": true,
              "veeamVBMRPLoginStatus": true,
              "veeamVBMRPUserID": true
            },
            "indexByName": {
              "Time": 0,
              "_start": 19,
              "_stop": 20,
              "_value": 3,
              "veeamVBMRPAppDN": 9,
              "veeamVBMRPAppID": 10,
              "veeamVBMRPLoginAppUsed": 11,
              "veeamVBMRPLoginBrowser": 4,
              "veeamVBMRPLoginDevice": 5,
              "veeamVBMRPLoginFailureReason": 12,
              "veeamVBMRPLoginID": 13,
              "veeamVBMRPLoginIP": 6,
              "veeamVBMRPLoginLocationCity": 14,
              "veeamVBMRPLoginLocationCityGEOLAT": 7,
              "veeamVBMRPLoginLocationCityGEOLONG": 8,
              "veeamVBMRPLoginLocationCountry": 15,
              "veeamVBMRPLoginLocationState": 16,
              "veeamVBMRPLoginStatus": 17,
              "veeamVBMRPUserDN": 1,
              "veeamVBMRPUserID": 18,
              "veeamVBMRPUserPN": 2
            },
            "renameByName": {
              "_value": "Number of Logins",
              "veeamVBMRPAppDN": "",
              "veeamVBMRPLoginAppUsed": "",
              "veeamVBMRPLoginBrowser": "Browser",
              "veeamVBMRPLoginDevice": "Operating System",
              "veeamVBMRPLoginIP": "IP Address",
              "veeamVBMRPLoginLocationCityGEOLAT": "Latitude",
              "veeamVBMRPLoginLocationCityGEOLONG": "Longitude",
              "veeamVBMRPUserDN": "User",
              "veeamVBMRPUserPN": "Username"
            }
          }
        }
      ],
      "type": "geomap"
    },
    {
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "dark-blue",
                "value": null
              }
            ]
          },
          "unit": "short"
        },
        "overrides": [
          {
            "matcher": {
              "id": "byFrameRefID",
              "options": "A"
            },
            "properties": [
              {
                "id": "displayName",
                "value": "Total Number of Logins"
              }
            ]
          },
          {
            "matcher": {
              "id": "byFrameRefID",
              "options": "B"
            },
            "properties": [
              {
                "id": "displayName",
                "value": "Number of logged Users"
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 3,
        "w": 6,
        "x": 18,
        "y": 0
      },
      "id": 9,
      "options": {
        "colorMode": "background",
        "graphMode": "none",
        "justifyMode": "center",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "textMode": "auto"
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPLoginID\"])\r\n  |> distinct(column: \"veeamVBMRPLoginID\")\r\n  |> group()\r\n  |> count()",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "hide": false,
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPUserDN\"])\r\n  |> distinct(column: \"veeamVBMRPUserDN\")\r\n  |> group()\r\n  |> count()",
          "refId": "B"
        }
      ],
      "type": "stat"
    },
    {
      "description": "Pie Chart with the most common used Web Browsers to login to the Veeam Restore Portal.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": [
          {
            "__systemRef": "hideSeriesFrom",
            "matcher": {
              "id": "byNames",
              "options": {
                "mode": "exclude",
                "names": [
                  "_value"
                ],
                "prefix": "All except:",
                "readOnly": true
              }
            },
            "properties": [
              {
                "id": "custom.hideFrom",
                "value": {
                  "legend": false,
                  "tooltip": false,
                  "viz": true
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 18,
        "y": 3
      },
      "id": 6,
      "options": {
        "displayLabels": [],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "values": []
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "none"
        }
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> filter(fn: (r) => r[\"_field\"] == \"veeamVBMRPLoginLocationCityGEOLAT\")\r\n  |> filter(fn: (r) => r[\"veeamVBMRPAppID\"] =~ /${RestorePortalID:regex}/)\r\n  |> group(columns: [\"veeamVBMRPLoginBrowser\"])\r\n  |> count()\r\n  |> yield(name: \"count\")",
          "refId": "A"
        }
      ],
      "title": "Logins by Web Browser",
      "transformations": [
        {
          "id": "labelsToFields",
          "options": {}
        },
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "_start": true,
              "_stop": true,
              "_value": false
            },
            "indexByName": {},
            "renameByName": {
              "veeamVBMRPLoginBrowser": "Browser"
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "description": "Pie Chart with the most common used Operating Systems to login to the Veeam Restore Portal.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "palette-classic"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": []
        },
        "overrides": []
      },
      "gridPos": {
        "h": 6,
        "w": 6,
        "x": 18,
        "y": 9
      },
      "id": 7,
      "options": {
        "displayLabels": [],
        "legend": {
          "displayMode": "table",
          "placement": "right",
          "values": []
        },
        "pieType": "donut",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": true
        },
        "tooltip": {
          "mode": "multi",
          "sort": "none"
        }
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> filter(fn: (r) => r[\"_field\"] == \"veeamVBMRPLoginLocationCityGEOLAT\")\r\n  |> filter(fn: (r) => r[\"veeamVBMRPAppID\"] =~ /${RestorePortalID:regex}/)\r\n  |> group(columns: [\"veeamVBMRPLoginDevice\"])\r\n  |> count()\r\n  |> yield(name: \"count\")",
          "refId": "A"
        }
      ],
      "title": "Logins by Operating System",
      "transformations": [
        {
          "id": "labelsToFields",
          "options": {}
        },
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "_start": true,
              "_stop": true,
              "_value": false
            },
            "indexByName": {},
            "renameByName": {
              "veeamVBMRPLoginBrowser": "Browser"
            }
          }
        }
      ],
      "type": "piechart"
    },
    {
      "description": "Please find all the Sign-in to the Veeam Restore Portal that you have selected from the drop-down menus. You can filter as well per ",
      "fieldConfig": {
        "defaults": {
          "color": {
            "fixedColor": "transparent",
            "mode": "fixed"
          },
          "custom": {
            "align": "auto",
            "displayMode": "auto"
          },
          "mappings": [
            {
              "options": {
                "0": {
                  "index": 0,
                  "text": "Success"
                },
                "50011": {
                  "index": 4,
                  "text": "Interrupted"
                },
                "50140": {
                  "index": 2,
                  "text": "Interrupted"
                },
                "50199": {
                  "index": 3,
                  "text": "Interrupted"
                },
                "65001": {
                  "index": 1,
                  "text": "Interrupted"
                }
              },
              "type": "value"
            }
          ],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "IP Address"
            },
            "properties": [
              {
                "id": "custom.align",
                "value": "center"
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Operating System"
            },
            "properties": [
              {
                "id": "custom.align",
                "value": "center"
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Country"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 80
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 11,
        "w": 24,
        "x": 0,
        "y": 15
      },
      "id": 4,
      "options": {
        "footer": {
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "Login Time"
          }
        ]
      },
      "pluginVersion": "8.3.3",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> filter(fn: (r) => r[\"_field\"] == \"veeamVBMRPLoginLocationCityGEOLAT\")\r\n  |> filter(fn: (r) => r[\"veeamVBMRPAppID\"] =~ /${RestorePortalID:regex}/)\r\n  |> filter(fn: (r) => r[\"veeamVBMRPLoginDevice\"] =~ /${RestorePortalUserDevice:regex}/)\r\n  |> filter(fn: (r) => r[\"veeamVBMRPLoginBrowser\"] =~ /${RestorePortalUserBrowser:regex}/)\r\n    |> filter(fn: (r) => r[\"veeamVBMRPUserPN\"] =~ /${RestorePortalUser:regex}/)\r\n  |> group(columns: [\"veeamVBMRPLoginID\"])\r\n  |> last()",
          "refId": "A"
        }
      ],
      "title": "Activity Details",
      "transformations": [
        {
          "id": "labelsToFields",
          "options": {
            "keepLabels": [
              "veeamVBMRPAppID"
            ],
            "mode": "columns"
          }
        },
        {
          "id": "merge",
          "options": {}
        },
        {
          "id": "organize",
          "options": {
            "excludeByName": {
              "_field": true,
              "_field {_start=\"2022-03-26 21:04:18.46 +0000 UTC\", _stop=\"2022-03-28 20:04:18.46 +0000 UTC\"}": true,
              "_measurement": true,
              "_measurement {_start=\"2022-03-26 21:04:18.46 +0000 UTC\", _stop=\"2022-03-28 20:04:18.46 +0000 UTC\"}": true,
              "_value": true,
              "_value {_start=\"2022-03-26 21:04:18.46 +0000 UTC\", _stop=\"2022-03-28 20:04:18.46 +0000 UTC\"}": true,
              "veeamVBMRPAppDN": true,
              "veeamVBMRPAppDN {_start=\"2022-03-26 21:04:18.46 +0000 UTC\", _stop=\"2022-03-28 20:04:18.46 +0000 UTC\"}": true,
              "veeamVBMRPAppID": true,
              "veeamVBMRPAppID {_start=\"2022-03-26 21:04:18.46 +0000 UTC\", _stop=\"2022-03-28 20:04:18.46 +0000 UTC\"}": true,
              "veeamVBMRPLoginFailureReason": true,
              "veeamVBMRPLoginID": true,
              "veeamVBMRPLoginLocationState": true,
              "veeamVBMRPUserID": true
            },
            "indexByName": {
              "_field": 2,
              "_measurement": 3,
              "_time": 0,
              "_value": 1,
              "veeamVBMRPAppDN": 4,
              "veeamVBMRPAppID": 5,
              "veeamVBMRPLoginAppUsed": 14,
              "veeamVBMRPLoginBrowser": 15,
              "veeamVBMRPLoginDevice": 16,
              "veeamVBMRPLoginFailureReason": 7,
              "veeamVBMRPLoginID": 6,
              "veeamVBMRPLoginIP": 13,
              "veeamVBMRPLoginLocationCity": 17,
              "veeamVBMRPLoginLocationCountry": 18,
              "veeamVBMRPLoginLocationState": 8,
              "veeamVBMRPLoginStatus": 12,
              "veeamVBMRPUserDN": 10,
              "veeamVBMRPUserID": 9,
              "veeamVBMRPUserPN": 11
            },
            "renameByName": {
              "_field": "",
              "_time": "Login Time",
              "_value": "",
              "_value {_start=\"2022-03-26 21:04:18.46 +0000 UTC\", _stop=\"2022-03-28 20:04:18.46 +0000 UTC\"}": "",
              "veeamVBMRPAppID": "",
              "veeamVBMRPLoginAppUsed": "Client app",
              "veeamVBMRPLoginBrowser": "User agent",
              "veeamVBMRPLoginDevice": "Operating System",
              "veeamVBMRPLoginFailureReason": "",
              "veeamVBMRPLoginIP": "IP Address",
              "veeamVBMRPLoginLocationCity": "City",
              "veeamVBMRPLoginLocationCountry": "Country",
              "veeamVBMRPLoginLocationState": "",
              "veeamVBMRPLoginStatus": "Status",
              "veeamVBMRPUserDN": "User",
              "veeamVBMRPUserID": "",
              "veeamVBMRPUserPN": "Username"
            }
          }
        }
      ],
      "type": "table"
    }
  ],
  "schemaVersion": 35,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "current": {},
        "definition": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPAppID\"])\r\n  |> distinct(column: \"veeamVBMRPAppID\")\r\n  |> group()\r\n",
        "hide": 0,
        "includeAll": true,
        "label": "Restore Portal ID",
        "multi": true,
        "name": "RestorePortalID",
        "options": [],
        "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPAppID\"])\r\n  |> distinct(column: \"veeamVBMRPAppID\")\r\n  |> group()\r\n",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query",
        "datasource": "${DS_INFLUXDB}"
      },
      {
        "current": {},
        "definition": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPUserPN\"])\r\n  |> distinct(column: \"veeamVBMRPUserPN\")\r\n  |> group()\r\n",
        "hide": 0,
        "includeAll": true,
        "label": "Restore Portal User",
        "multi": true,
        "name": "RestorePortalUser",
        "options": [],
        "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPUserPN\"])\r\n  |> distinct(column: \"veeamVBMRPUserPN\")\r\n  |> group()\r\n",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query",
        "datasource": "${DS_INFLUXDB}"
      },
      {
        "current": {},
        "definition": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPLoginDevice\"])\r\n  |> distinct(column: \"veeamVBMRPLoginDevice\")\r\n  |> group()\r\n",
        "hide": 0,
        "includeAll": true,
        "label": "Restore Portal User Device",
        "multi": true,
        "name": "RestorePortalUserDevice",
        "options": [],
        "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPLoginDevice\"])\r\n  |> distinct(column: \"veeamVBMRPLoginDevice\")\r\n  |> group()\r\n",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query",
        "datasource": "${DS_INFLUXDB}"
      },
      {
        "current": {},
        "definition": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPLoginBrowser\"])\r\n  |> distinct(column: \"veeamVBMRPLoginBrowser\")\r\n  |> group()\r\n",
        "hide": 0,
        "includeAll": true,
        "label": "Restore Portal User Browser",
        "multi": true,
        "name": "RestorePortalUserBrowser",
        "options": [],
        "query": "from(bucket: v.defaultBucket)\r\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\r\n  |> filter(fn: (r) => r[\"_measurement\"] == \"veeam_microsoft365_audit\")\r\n  |> keep(columns: [\"veeamVBMRPLoginBrowser\"])\r\n  |> distinct(column: \"veeamVBMRPLoginBrowser\")\r\n  |> group()\r\n",
        "refresh": 2,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "type": "query",
        "datasource": "${DS_INFLUXDB}"
      }
    ]
  },
  "time": {
    "from": "now-30d",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Grafana Dashboard for User Audit VB365",
  "uid": "95dahKy7z",
  "version": 16,
  "weekStart": "",
  "gnetId": 15997
}