coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Give the demo a live synthetic fleet, dashboards, and alert rules

Browse Source 
The demo had 75k generic records across eight host-0N/service pairs, one
dashboard, one alert rule, and -- because nothing ever called
AgentControl.CheckIn -- a completely empty Agents page.

/hack/demo-simulator replaces the generic data with a fictional but
coherent fleet: 14 hosts running nginx, an API tier, workers, Postgres,
Redis, mail, Linux journals and Windows event logs, whose messages and
attributes look like what those services actually write. It backfills a
week (~370k records, ~20s) and then keeps running.

Running continuously is the point, not an implementation detail. Three
things the demo has to show are only true if data keeps arriving: the
Agents page marks a host stale once check-ins stop, alert rules evaluate
over trailing windows and would freeze in one state against a static
dataset, and any "last 15 minutes" view is empty on data that stopped
growing overnight. It also emits metrics/heartbeats and answers CheckIn
faithfully enough that the remote-config editor's pending -> applied
transition works end to end.

Seeded incidents give the data something to find: an api-02 outage with
matching slow queries on db-01, 5xx at the edge and cascading job
failures; an SSH probe burst; a spam wave; a disk filling up; and one
decommissioned host left deliberately stale.

/hack/demo-seed holds the rest of the deployment -- the nightly reset,
eight dashboards (64 panels, every viz type but line), eleven alert
rules across three notification targets, and the systemd unit. Rule
thresholds are calibrated against what the simulator actually produces:
the first pass had four rules whose thresholds the traffic could never
reach and one that fired during normal operation.

No line charts: dashboard panels reject the raw-SQL escape hatch, and
the pipe language has no time-bucketing, so a real time axis isn't
expressible today. Noted in demo-seed/README.md rather than papered
over.
This commit is contained in:
jcoffey-dev
2026-08-22 16:12:35 -07:00
parent e6a58f58ea
commit bcb9a01cd6
31 changed files with 3031 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hack/demo-seed/dashboards/database-cache.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Database & cache",
"description": "Postgres statement latency and Redis memory pressure",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Slow queries (>1s)",
"query": "service=postgres | where duration_ms>1000 | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Avg statement (ms)",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=postgres | stats avg(duration_ms) as avg_duration_ms",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "Redis evictions",
"query": "service=redis op=evict | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Statements by kind",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=postgres | stats count by query_kind | sort -count",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "query_kind",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Slowest tables (avg ms)",
"query": "service=postgres | stats avg(duration_ms) as avg_duration_ms by table | sort -avg_duration_ms | head 10",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "table",
"value_column": "avg_duration_ms"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Statement kind by table",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=postgres | stats count by table, query_kind",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "table",
"y_column": "query_kind",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Redis events by operation",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=redis | stats count by op | sort -count",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "op",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Slowest statements",
"query": "service=postgres | where duration_ms>1000 | sort -duration_ms | head 50 | fields timestamp, table, query_kind, duration_ms, message",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/errors-reliability.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Errors & reliability",
"description": "Where failures are concentrated right now -- 5xx, fatal events, and failed background jobs",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Error events",
"query": "severity=ERROR | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Fatal events",
"query": "severity=FATAL | stats count",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "Failed jobs",
"query": "service=worker result=failed | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Errors by service",
"query": "severity=ERROR | stats count by service | sort -count",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "service",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Top API error codes",
"query": "service=api | where status>=500 | stats count by error_code | sort -count | head 10",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "error_code",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "5xx by host and status",
"query": "status>=500 | stats count by host, status",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"y_column": "status",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Failed jobs by queue",
"query": "service=worker result=failed | stats count by queue | sort -count",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "queue",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Recent 5xx responses",
"query": "status>=500 | sort -timestamp | head 50 | fields timestamp, host, service, status, route, message",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/infrastructure.json
+112
View File
@@ -0,0 +1,112 @@
{
"name": "Infrastructure",
"description": "Agent-reported CPU, memory, and disk for every host in the fleet",
"default_earliest": "-6h",
"default_latest": "now",
"panels": [
{
"title": "Metric samples",
"query": "cairnobs.metrics=true | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Peak CPU (%)",
"query": "cairnobs.metrics=true | stats max(cpu_percent) as max_cpu_percent",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "Agent heartbeats",
"query": "cairnobs.heartbeat=true | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Average CPU by host",
"query": "cairnobs.metrics=true | stats avg(cpu_percent) as avg_cpu_percent by host | sort -avg_cpu_percent",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"value_column": "avg_cpu_percent"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Disk used by host (bytes)",
"query": "cairnobs.metrics=true | stats max(disk_used_bytes) as disk_used_bytes by host | sort -disk_used_bytes | head 12",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "host",
"value_column": "disk_used_bytes"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Memory used by host (bytes)",
"query": "cairnobs.metrics=true | stats max(mem_used_bytes) as mem_used_bytes by host | sort -mem_used_bytes",
"viz_type": "bar",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"value_column": "mem_used_bytes"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Heartbeats by host",
"query": "cairnobs.heartbeat=true | stats count by host | sort -count",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Latest sample per host",
"query": "cairnobs.metrics=true | stats max(uptime_seconds) as uptime_seconds, avg(cpu_percent) as avg_cpu_percent, max(cpu_cores) as cores by host | sort -avg_cpu_percent",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/mail-delivery.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Mail delivery",
"description": "SMTP delivery outcomes, authentication failures, and spam rejections on the mail host",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Delivered",
"query": "service=smtp result=delivered | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Auth failures",
"query": "service=smtp result=auth_failed | stats count",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "Spam rejections",
"query": "service=smtp result=spam_reject | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Outcomes",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=smtp | stats count by result | sort -count",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "result",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Top sender domains",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=smtp | stats count by sender_domain | sort -count | head 10",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "sender_domain",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Outcome by sender domain",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=smtp | stats count by sender_domain, result",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "sender_domain",
"y_column": "result",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Auth failures by source address",
"query": "service=smtp result=auth_failed | stats count by remote_addr | sort -count | head 10",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "remote_addr",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Recent rejections",
"query": "service=smtp result=spam_reject | sort -timestamp | head 50 | fields timestamp, remote_addr, sender_domain, spam_score, message",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/security.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Security",
"description": "SSH authentication, firewall blocks, and Windows logon failures across the fleet",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Failed SSH logins",
"query": "service=system auth_result=failed | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Firewall blocks",
"query": "service=system ufw_action=BLOCK | stats count",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "Windows logon failures",
"query": "winevt.event_id=4625 | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Top source addresses",
"query": "service=system auth_result=failed | stats count by remote_addr | sort -count | head 10",
"viz_type": "top_n",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "remote_addr",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Blocked destination ports",
"query": "service=system ufw_action=BLOCK | stats count by dst_port | sort -count | head 12",
"viz_type": "bar",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "dst_port",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Source address by blocked port",
"query": "service=system ufw_action=BLOCK | stats count by remote_addr, dst_port",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "remote_addr",
"y_column": "dst_port",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Failed logins by host",
"query": "service=system auth_result=failed | stats count by host | sort -count",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Recent authentication failures",
"query": "service=system auth_result=failed | sort -timestamp | head 50 | fields timestamp, host, ssh_user, remote_addr, message",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/service-overview.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Service overview",
"description": "Every service at a glance: volume, error mix, and the hosts carrying the load",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Log events",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Errors",
"query": "severity=ERROR | stats count",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "5xx responses",
"query": "status>=500 | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Events by service",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true | stats count by service | sort -count",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "service",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Busiest hosts",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true | stats count by host | sort -count | head 10",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "host",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Severity by service",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true | stats count by service, severity",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "service",
"y_column": "severity",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Errors by host",
"query": "severity=ERROR | stats count by host | sort -count",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Most recent errors",
"query": "severity=ERROR | sort -timestamp | head 50 | fields timestamp, host, service, message",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/web-api-traffic.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Web & API traffic",
"description": "Edge (nginx) and application (api) tiers: status mix, hot routes, and latency",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Edge requests",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=nginx | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Avg API latency (ms)",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=api | stats avg(latency_ms) as avg_latency_ms",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "API 5xx",
"query": "service=api | where status>=500 | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Edge responses by status",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=nginx | stats count by status | sort -count",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "status",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Busiest routes",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=nginx | stats count by route | sort -count | head 10",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "route",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Status by edge host",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=nginx | stats count by host, status",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "host",
"y_column": "status",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Slowest API routes (avg ms)",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=api | stats avg(latency_ms) as avg_latency_ms by route | sort -avg_latency_ms | head 10",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "route",
"value_column": "avg_latency_ms"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Slow API requests (>800ms)",
"query": "service=api | where latency_ms>800 | sort -timestamp | head 50 | fields timestamp, host, route, status, latency_ms, trace_id",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}
hack/demo-seed/dashboards/windows-events.json
+113
View File
@@ -0,0 +1,113 @@
{
"name": "Windows events",
"description": "Security, System, and Application channels from the Windows hosts",
"default_earliest": "-24h",
"default_latest": "now",
"panels": [
{
"title": "Windows events",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=eventlog | stats count",
"viz_type": "single_stat",
"position_x": 0,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 0
},
{
"title": "Failed logons (4625)",
"query": "winevt.event_id=4625 | stats count",
"viz_type": "single_stat",
"position_x": 4,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 1
},
{
"title": "Account lockouts (4740)",
"query": "winevt.event_id=4740 | stats count",
"viz_type": "single_stat",
"position_x": 8,
"position_y": 0,
"width": 4,
"height": 3,
"query_language": "spl",
"sort_order": 2
},
{
"title": "Events by ID",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=eventlog | stats count by winevt.event_id | sort -count | head 12",
"viz_type": "bar",
"position_x": 0,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "winevt.event_id",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 3
},
{
"title": "Top providers",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=eventlog | stats count by winevt.provider | sort -count | head 10",
"viz_type": "top_n",
"position_x": 6,
"position_y": 3,
"width": 6,
"height": 5,
"viz_config": {
"label_column": "winevt.provider",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 4
},
{
"title": "Channel by computer",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=eventlog | stats count by winevt.computer, winevt.channel",
"viz_type": "heatmap",
"position_x": 0,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "winevt.computer",
"y_column": "winevt.channel",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 5
},
{
"title": "Severity mix",
"query": "cairnobs.metrics!=true cairnobs.heartbeat!=true service=eventlog | stats count by severity | sort -count",
"viz_type": "bar",
"position_x": 6,
"position_y": 8,
"width": 6,
"height": 5,
"viz_config": {
"x_column": "severity",
"value_column": "count"
},
"query_language": "spl",
"sort_order": 6
},
{
"title": "Recent security-channel events",
"query": "service=eventlog winevt.channel=Security | sort -timestamp | head 50 | fields timestamp, winevt.computer, winevt.event_id, winevt.target_user, message",
"viz_type": "table",
"position_x": 0,
"position_y": 13,
"width": 12,
"height": 6,
"query_language": "spl",
"sort_order": 7
}
]
}