jcoffey-dev
f6c228b87c
The estate could show an operator their infrastructure and had nothing to say to the business paying for it. Two storefronts and the gateway behind both fix that: Magento on two hosts, WooCommerce on one, and pay-01 carrying authorisations with amount, gateway and decline reason. Orders, revenue, average order value, where checkout loses people and why a card was refused now come out of the same log lines the operators are already reading, which is the argument for not running a separate metrics stack beside this one. Two platforms rather than one deliberately. Magento and WooCommerce write about the same events differently, so a panel that groups by service instead of assuming a single shape is the honest way to build one -- and the demo shows that rather than describing it. Order totals are built from a basket of real SKUs at real prices rather than drawn from a distribution, so average order value moves the way one actually moves. Declines rise during the seeded outage window alongside the 5xx rate, because whatever fails requests fails authorisations too. Twenty-seven new alert rules, thresholds calibrated against what the fleet actually emits -- measured on the demo's own week of history rather than guessed. A rule set at the average fires constantly and one set an order of magnitude above it never fires; these sit two to three times the steady-state rate, so they are quiet in normal operation and true during the diurnal peak or the seeded incident. Four are absence rules, because a domain controller or a storefront going silent is not a threshold question. Six new dashboards: fleet health, golden signals, security posture, capacity and storage, commerce, payments. Three limits of the query language found the hard way and worth writing down, because each was discovered by a panel failing rather than by reading: `dc()` does not exist -- the functions are count, sum, avg, min and max; `or` is not supported between structured filters, so a panel spanning tiers filters on the attribute they share and groups by service; and dashboards refuse raw SQL outright. The validator run over all 169 panels and 38 rules now checks every one of those, plus stages, viz types and comparators.
14 lines
502 B
Plaintext
14 lines
502 B
Plaintext
{
|
|
"name": "SQL Server login failures",
|
|
"description": "Repeated failed logins against SQL Server -- credential stuffing against a service account, or an application with a stale password",
|
|
"query": "service=mssql event_kind=login_failed earliest=-10m | stats count",
|
|
"query_language": "spl",
|
|
"condition_type": "threshold",
|
|
"eval_interval_seconds": 60,
|
|
"for_minutes": 0,
|
|
"notification_target_id": "__TARGET_SECURITY__",
|
|
"enabled": true,
|
|
"comparator": "gt",
|
|
"threshold_value": 12
|
|
}
|