|
|
|
@@ -1,163 +0,0 @@
|
|
|
|
|
{
|
|
|
|
|
"annotations": {"list": []},
|
|
|
|
|
"description": "CrowdSec: Erkennung im Cluster, Durchsetzung am NetBird-Edge",
|
|
|
|
|
"editable": true,
|
|
|
|
|
"fiscalYearStartMonth": 0,
|
|
|
|
|
"graphTooltip": 1,
|
|
|
|
|
"id": null,
|
|
|
|
|
"links": [],
|
|
|
|
|
"panels": [
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Aktive Ban-Entscheidungen in der LAPI, ganz überwiegend aus den CAPI-Community-Blocklisten. Das ist die Menge, die ein scharfgeschalteter Bouncer durchsetzt.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "thresholds"}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "text", "value": null}]}, "unit": "short"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 4, "w": 6, "x": 0, "y": 0},
|
|
|
|
|
"id": 1,
|
|
|
|
|
"options": {"colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false}, "textMode": "auto"},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum(cs_active_decisions)", "refId": "A"}],
|
|
|
|
|
"title": "Aktive Decisions",
|
|
|
|
|
"type": "stat"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Bouncer, die in den letzten 10 Minuten Decisions abgeholt haben. Fällt das unter die erwartete Zahl, holt ein Bouncer nichts mehr — und setzt damit einen veralteten Stand durch, ohne dass irgendetwas ausfällt.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "thresholds"}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "red", "value": null}, {"color": "green", "value": 1}]}, "unit": "short"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 4, "w": 6, "x": 6, "y": 0},
|
|
|
|
|
"id": 2,
|
|
|
|
|
"options": {"colorMode": "value", "graphMode": "none", "justifyMode": "auto", "orientation": "auto", "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false}, "textMode": "auto"},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "count(sum by (bouncer) (rate(cs_lapi_bouncer_requests_total[10m])) > 0)", "refId": "A"}],
|
|
|
|
|
"title": "Bouncer, die abholen",
|
|
|
|
|
"type": "stat"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Vom Agent gelesene Logzeilen pro Sekunde. Steht das auf 0, detektiert CrowdSec nichts mehr — der häufigste stille Ausfall, weil alles andere weiterläuft.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "thresholds"}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "red", "value": null}, {"color": "green", "value": 0.01}]}, "unit": "reqps"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 4, "w": 6, "x": 12, "y": 0},
|
|
|
|
|
"id": 3,
|
|
|
|
|
"options": {"colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false}, "textMode": "auto"},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum(rate(cs_filesource_hits_total[5m]))", "refId": "A"}],
|
|
|
|
|
"title": "Gelesene Logzeilen/s",
|
|
|
|
|
"type": "stat"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Szenario-Overflows der letzten 24 h — also lokal erkannte Angriffe, im Gegensatz zu den von CAPI übernommenen.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "thresholds"}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "text", "value": null}]}, "unit": "short"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 4, "w": 6, "x": 18, "y": 0},
|
|
|
|
|
"id": 4,
|
|
|
|
|
"options": {"colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false}, "textMode": "auto"},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum(increase(cs_bucket_overflowed_total[24h]))", "refId": "A"}],
|
|
|
|
|
"title": "Lokale Overflows (24 h)",
|
|
|
|
|
"type": "stat"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Abholrate je Bouncer. Der Firewall-Bouncer auf den Proxies fragt alle 10 s. Die LAPI legt bei jeder neuen beobachteten Client-Adresse einen Eintrag `<name>@<ip>` an, und beobachtet wird die Pod-IP des netbird-ingress-Peers — deshalb erscheint ein logischer Bouncer hier mehrfach und nach Pod-Rollen unter neuen Namen.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "palette-classic"}, "custom": {"axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": {"legend": false, "tooltip": false, "viz": false}, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": {"type": "linear"}, "showPoints": "never", "spanNulls": false, "stacking": {"group": "A", "mode": "none"}, "thresholdsStyle": {"mode": "off"}}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}]}, "unit": "reqps"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 8, "w": 12, "x": 0, "y": 4},
|
|
|
|
|
"id": 5,
|
|
|
|
|
"options": {"legend": {"calcs": ["lastNotNull"], "displayMode": "table", "placement": "right", "showLegend": true}, "tooltip": {"mode": "multi", "sort": "desc"}},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum by (bouncer) (rate(cs_lapi_bouncer_requests_total[5m]))", "legendFormat": "{{bouncer}}", "refId": "A"}],
|
|
|
|
|
"title": "Bouncer-Abholrate",
|
|
|
|
|
"type": "timeseries"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Aktive Decisions nach Grund. `http:scan` dominiert und stammt aus den CAPI-Blocklisten.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "palette-classic"}, "custom": {"axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "line", "fillOpacity": 20, "gradientMode": "none", "hideFrom": {"legend": false, "tooltip": false, "viz": false}, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": {"type": "linear"}, "showPoints": "never", "spanNulls": false, "stacking": {"group": "A", "mode": "normal"}, "thresholdsStyle": {"mode": "off"}}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}]}, "unit": "short"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 8, "w": 12, "x": 12, "y": 4},
|
|
|
|
|
"id": 6,
|
|
|
|
|
"options": {"legend": {"calcs": ["lastNotNull"], "displayMode": "table", "placement": "right", "showLegend": true}, "tooltip": {"mode": "multi", "sort": "desc"}},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum by (reason) (cs_active_decisions)", "legendFormat": "{{reason}}", "refId": "A"}],
|
|
|
|
|
"title": "Aktive Decisions nach Grund",
|
|
|
|
|
"type": "timeseries"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Welche Szenarien lokal auslösen. Das ist das, was CrowdSec selbst aus den Traefik-Logs erkennt.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "palette-classic"}, "custom": {"axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "bars", "fillOpacity": 70, "gradientMode": "none", "hideFrom": {"legend": false, "tooltip": false, "viz": false}, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": {"type": "linear"}, "showPoints": "never", "spanNulls": false, "stacking": {"group": "A", "mode": "normal"}, "thresholdsStyle": {"mode": "off"}}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}]}, "unit": "short"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 8, "w": 12, "x": 0, "y": 12},
|
|
|
|
|
"id": 7,
|
|
|
|
|
"options": {"legend": {"calcs": ["sum"], "displayMode": "table", "placement": "right", "showLegend": true}, "tooltip": {"mode": "multi", "sort": "desc"}},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum by (name) (increase(cs_bucket_overflowed_total[1h]))", "legendFormat": "{{name}}", "refId": "A"}],
|
|
|
|
|
"title": "Szenario-Overflows (je Stunde)",
|
|
|
|
|
"type": "timeseries"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Geparste gegen nicht geparste Zeilen. Ein Anstieg bei `ko` heißt meist, dass sich ein Logformat geändert hat und der Parser nicht mehr greift — CrowdSec liest dann weiter, erkennt aber nichts mehr.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "palette-classic"}, "custom": {"axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": {"legend": false, "tooltip": false, "viz": false}, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": {"type": "linear"}, "showPoints": "never", "spanNulls": false, "stacking": {"group": "A", "mode": "none"}, "thresholdsStyle": {"mode": "off"}}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}]}, "unit": "reqps"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 8, "w": 12, "x": 12, "y": 12},
|
|
|
|
|
"id": 8,
|
|
|
|
|
"options": {"legend": {"calcs": ["lastNotNull"], "displayMode": "list", "placement": "bottom", "showLegend": true}, "tooltip": {"mode": "multi", "sort": "desc"}},
|
|
|
|
|
"targets": [
|
|
|
|
|
{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum(rate(cs_parser_hits_ok_total[5m]))", "legendFormat": "geparst", "refId": "A"},
|
|
|
|
|
{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum(rate(cs_parser_hits_ko_total[5m]))", "legendFormat": "nicht geparst", "refId": "B"}
|
|
|
|
|
],
|
|
|
|
|
"title": "Parser",
|
|
|
|
|
"type": "timeseries"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"description": "Whitelist-Treffer nach Grund. Nützlich beim Scharfschalten: was hier zählt, wäre sonst ein Kandidat für einen Ban gewesen.",
|
|
|
|
|
"fieldConfig": {
|
|
|
|
|
"defaults": {"color": {"mode": "palette-classic"}, "custom": {"axisCenteredZero": false, "axisColorMode": "text", "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "line", "fillOpacity": 10, "gradientMode": "none", "hideFrom": {"legend": false, "tooltip": false, "viz": false}, "lineInterpolation": "linear", "lineWidth": 1, "pointSize": 5, "scaleDistribution": {"type": "linear"}, "showPoints": "never", "spanNulls": false, "stacking": {"group": "A", "mode": "none"}, "thresholdsStyle": {"mode": "off"}}, "mappings": [], "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}]}, "unit": "reqps"},
|
|
|
|
|
"overrides": []
|
|
|
|
|
},
|
|
|
|
|
"gridPos": {"h": 8, "w": 12, "x": 0, "y": 20},
|
|
|
|
|
"id": 9,
|
|
|
|
|
"options": {"legend": {"calcs": ["lastNotNull"], "displayMode": "table", "placement": "right", "showLegend": true}, "tooltip": {"mode": "multi", "sort": "desc"}},
|
|
|
|
|
"targets": [{"datasource": {"type": "prometheus", "uid": "prometheus"}, "expr": "sum by (reason) (rate(cs_node_wl_hits_ok_total[5m]))", "legendFormat": "{{reason}}", "refId": "A"}],
|
|
|
|
|
"title": "Whitelist-Treffer",
|
|
|
|
|
"type": "timeseries"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"datasource": {"type": "prometheus", "uid": "prometheus"},
|
|
|
|
|
"gridPos": {"h": 8, "w": 12, "x": 12, "y": 20},
|
|
|
|
|
"id": 10,
|
|
|
|
|
"options": {
|
|
|
|
|
"code": {"language": "plaintext", "showLineNumbers": false, "showMiniMap": false},
|
|
|
|
|
"content": "## Was dieses Dashboard NICHT zeigt\n\nAlle Panels stammen aus der LAPI und den Agents im Cluster. Die **Bouncer auf proxy-1 und proxy-2 exportieren eigene Metriken**, die hier fehlen:\n\n- `fw_bouncer_active_decisions` — was tatsächlich in den nftables-Sets steht\n- `fw_bouncer_dropped_packets` / `_bytes` — was wirklich verworfen wurde\n- `lapi_requests_total` / `_failures_total` — aus Sicht des Bouncers\n\nSie liegen auf `127.0.0.1:60601` der Proxy-Hosts. Die Hosts sind öffentlich und haben bisher keinerlei Metrik-Pfad; den Port ins Internet zu öffnen, nur um ein Scrape-Ziel zu bekommen, wäre der falsche Tausch.\n\n**Konsequenz:** „Bouncer-Abholrate\" oben zeigt, dass ein Bouncer *fragt* — nicht, dass er die Antwort auch angewandt hat. Solange der Modus `dry-run` ist, wendet er ohnehin nichts an.\n\nEin Scrape-Pfad für die Hosts ist eigene Arbeit und Voraussetzung dafür, dass „was wird wirklich geblockt\" beantwortbar wird."
|
|
|
|
|
},
|
|
|
|
|
"title": "Blinder Fleck",
|
|
|
|
|
"type": "text"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"refresh": "30s",
|
|
|
|
|
"schemaVersion": 38,
|
|
|
|
|
"style": "dark",
|
|
|
|
|
"tags": ["homelab", "crowdsec", "security"],
|
|
|
|
|
"templating": {"list": []},
|
|
|
|
|
"time": {"from": "now-6h", "to": "now"},
|
|
|
|
|
"timepicker": {},
|
|
|
|
|
"timezone": "",
|
|
|
|
|
"title": "CrowdSec Overview",
|
|
|
|
|
"uid": "crowdsec-overview",
|
|
|
|
|
"version": 1,
|
|
|
|
|
"weekStart": ""
|
|
|
|
|
}
|
claude-botandClaude Opus 5