From 63a4dd89ee479e362e5ecc47836ca9600ddff820 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Wed, 1 Sep 2021 10:17:39 +0200
Subject: [PATCH] dashboards for devsecops

---
 dist/devsecops/default/data/ui/views/analytics.xml      | 7 +++++++
 dist/devsecops/default/data/ui/views/user_analytics.xml | 7 +++++++
 2 files changed, 14 insertions(+)
 create mode 100644 dist/devsecops/default/data/ui/views/analytics.xml
 create mode 100644 dist/devsecops/default/data/ui/views/user_analytics.xml

diff --git a/dist/devsecops/default/data/ui/views/analytics.xml b/dist/devsecops/default/data/ui/views/analytics.xml
new file mode 100644
index 0000000000..0e9902557d
--- /dev/null
+++ b/dist/devsecops/default/data/ui/views/analytics.xml
@@ -0,0 +1,7 @@
+
+        <dashboard version="2" theme="dark">
+            <label>Analytics</label>
+            <description></description>
+            <definition><![CDATA[{"dataSources":{"ds_search_1_new":{"type":"ds.search","options":{"query":"index=alerts | fillnull | rename source as rule | stats count by rule user severity risk_score","queryParameters":{"earliest":"-24h@h","latest":"now"}}},"ds_search_1":{"type":"ds.search","options":{"query":"index=* | stats count","queryParameters":{"earliest":"-24h@h","latest":"now"}}},"ds_wW9gjFgQ_ds_search_1":{"type":"ds.search","options":{"query":"index=alerts | stats count","queryParameters":{"earliest":"-24h@h","latest":"now"}}},"ds_axw5oiSl_ds_search_1":{"type":"ds.search","options":{"query":"index=signals | stats count","queryParameters":{"earliest":"-24h@h","latest":"now"}}},"ds_fmqYkyMv_ds_wW9gjFgQ_ds_search_1":{"type":"ds.search","options":{"query":"index=incidents | stats count","queryParameters":{"earliest":"-24h@h","latest":"now"}}},"ds_CWO6UQi8_ds_search_1_new":{"type":"ds.search","options":{"query":"index=alerts | fillnull | rename source as rule | stats count by rule user severity risk_score","queryParameters":{"earliest":"-24h@h","latest":"now"}}}},"visualizations":{"viz_table_1_new":{"type":"splunk.table","options":{"count":20,"dataOverlayMode":"none","drilldown":"none","percentagesRow":false,"rowNumbers":false,"totalsRow":false,"wrap":true},"dataSources":{"primary":"ds_search_1_new"},"title":"Top Alerts"},"viz_table_1":{"type":"viz.singlevalueradial","dataSources":{"primary":"ds_search_1"},"title":"Events"},"viz_pRaWBJLC":{"type":"viz.singlevalueradial","dataSources":{"primary":"ds_wW9gjFgQ_ds_search_1"},"title":"Alerts"},"viz_0YdDTANy":{"type":"viz.singlevalueradial","dataSources":{"primary":"ds_axw5oiSl_ds_search_1"},"title":"Signals"},"viz_cLn0gi67":{"type":"viz.singlevalueradial","dataSources":{"primary":"ds_fmqYkyMv_ds_wW9gjFgQ_ds_search_1"},"title":"Incidents"},"viz_O09Luv4C":{"type":"splunk.table","options":{"count":20,"dataOverlayMode":"none","drilldown":"none","percentagesRow":false,"rowNumbers":false,"totalsRow":false,"wrap":true},"dataSources":{"primary":"ds_CWO6UQi8_ds_search_1_new"},"title":"Top Alerts"}},"inputs":{"input_global_trp":{"type":"input.timerange","options":{"token":"global_time","defaultValue":"-7d@h,now"},"title":"Global Time Range"}},"layout":{"type":"grid","options":{},"structure":[{"item":"viz_table_1","type":"block","position":{"x":0,"y":0,"w":300,"h":250}},{"item":"viz_0YdDTANy","type":"block","position":{"x":300,"y":0,"w":300,"h":250}},{"item":"viz_pRaWBJLC","type":"block","position":{"x":600,"y":0,"w":300,"h":250}},{"item":"viz_cLn0gi67","type":"block","position":{"x":900,"y":0,"w":300,"h":250}},{"item":"viz_table_1_new","type":"block","position":{"x":0,"y":250,"w":600,"h":300}},{"item":"viz_O09Luv4C","type":"block","position":{"x":600,"y":250,"w":600,"h":300}}],"globalInputs":["input_global_trp"]},"title":"Analytics","defaults":{"dataSources":{"ds.search":{"options":{"queryParameters":{"latest":"$global_time.latest$","earliest":"$global_time.earliest$"}}}}}}]]></definition>
+            <assets><![CDATA[{}]]></assets>
+        </dashboard>
\ No newline at end of file
diff --git a/dist/devsecops/default/data/ui/views/user_analytics.xml b/dist/devsecops/default/data/ui/views/user_analytics.xml
new file mode 100644
index 0000000000..ace8da6cc2
--- /dev/null
+++ b/dist/devsecops/default/data/ui/views/user_analytics.xml
@@ -0,0 +1,7 @@
+
+        <dashboard version="2" theme="dark">
+            <label>User Analytics</label>
+            <description></description>
+            <definition><![CDATA[{"visualizations":{"viz_wgHQmxHz":{"type":"viz.rectangle","options":{"rx":4,"stroke":"transparent","fill":"#08080A","fillOpacity":0.7}},"viz_HBndDcC8":{"type":"viz.rectangle","options":{"rx":4,"stroke":"transparent","fill":"#08080A","fillOpacity":0.7}},"viz_vPNP9DGA":{"type":"viz.text","options":{"content":"User Analytics","textColor":"#ffffff","fontWeight":"bold","fontFamily":"Splunk Platform Sans","fontSize":30}},"viz_trxVvFuq":{"type":"viz.table","options":{"headerTextColor":"#ffffff","rowTextColorOdd":"#ffffff","rowTextColorEven":"#ffffff","backgroundColor":"transparent","headerBackgroundColor":"#0E6162","rowBackgroundColorEven":"#08090A","rowBackgroundColorOdd":"transparent","rowNumbers":true},"dataSources":{"primary":"ds_LIRVs8HJ"},"title":""},"viz_XpNIREXZ":{"type":"viz.rectangle","options":{"fill":"#08080A","stroke":"#6AD6D7","strokeWidth":4,"rx":4,"fillOpacity":0.7}},"viz_HVakKuF4":{"type":"viz.text","options":{"content":"Total Signals","textColor":"#ffffff","fontSize":16,"fontFamily":"Splunk Platform Sans"}},"viz_2hzTTzmg":{"type":"splunk.singlevalue","dataSources":{"primary":"ds_kYoaiRUv_ds_Ui7HgXoq"},"encoding":{"majorColor":{"field":"primary[0]","format":{"type":"rangevalue","ranges":[{"from":10,"value":"#8AD6A5"},{"to":10,"value":"#5fbcff"}]}}},"title":"","options":{"backgroundColor":"transparent"}},"viz_dqiBE1n6":{"type":"viz.text","options":{"content":"Total Alerts","textColor":"#ffffff","fontSize":16,"fontFamily":"Splunk Platform Sans"}},"viz_HJSvzC9V":{"type":"splunk.singlevalue","dataSources":{"primary":"ds_42O6TeFY_ds_kYoaiRUv_ds_Ui7HgXoq"},"encoding":{"majorColor":{"field":"primary[0]","format":{"type":"rangevalue","ranges":[{"from":50,"value":"#D6867E"},{"to":50,"value":"#5fbcff"}]}}},"title":"","options":{"backgroundColor":"transparent"}},"viz_SFmd93VH":{"type":"viz.text","options":{"content":"Alerts for AAAAAAAAAAAAAAAAAAAAA:test@test.com","textColor":"#ffffff","fontWeight":"bold","fontFamily":"Splunk Platform Sans","fontSize":30}},"viz_6jDDhnpN":{"type":"viz.rectangle","options":{"fill":"#08080A","stroke":"#6AD6D7","strokeWidth":4,"rx":4,"fillOpacity":0.7}},"viz_92624TGo":{"type":"viz.table","options":{"headerTextColor":"#ffffff","rowTextColorOdd":"#ffffff","rowTextColorEven":"#ffffff","backgroundColor":"transparent","headerBackgroundColor":"#0E6162","rowBackgroundColorEven":"#08090A","rowBackgroundColorOdd":"transparent","rowNumbers":true},"dataSources":{"primary":"ds_dzifVa29_ds_LIRVs8HJ"},"title":""},"viz_RAf7HqQX":{"type":"viz.text","options":{"content":"Signals for AAAAAAAAAAAAAAAAAAAAA:test@test.com","textColor":"#ffffff","fontWeight":"bold","fontFamily":"Splunk Platform Sans","fontSize":30}},"viz_IHs7L0T4":{"type":"viz.rectangle","options":{"rx":4,"stroke":"transparent","fill":"#08080A","fillOpacity":0.7}},"viz_kLinhZzt":{"type":"viz.text","options":{"content":"Historical Alerts last 30 days","textColor":"#ffffff","fontSize":16,"fontFamily":"Splunk Platform Sans"}},"viz_LMIiUGeq":{"type":"viz.area","options":{"backgroundColor":"transparent","areaFillOpacity":0.4,"foregroundColor":"#cccccc","fontColor":"#cccccc","axisTitleX.visibility":"collapsed","axisTitleY.visibility":"collapsed","axisLabelsX.majorLabelVisibility":"hide","axisLabelsY.majorLabelVisibility":"hide","gridLinesX.showMajorLines":false,"gridLinesY.showMajorLines":false,"seriesColors":"[#EC4B43]","legend.placement":"none"},"dataSources":{"primary":"ds_Ass1Td1P"}}},"dataSources":{"ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts OR index=signals | stats dc(user)"},"name":"Triage Time"},"ds_JhEHlFy5_ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts OR index=signals | stats dc(host)"},"name":"Admission Time"},"ds_4pBgG928_ds_JhEHlFy5_ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"| makeresults\n| eval Value=\"18\""},"name":"Evaluation Time"},"ds_LIRVs8HJ":{"type":"ds.search","options":{"query":"index=alerts user=$token_user$ | fillnull | rename source as rule | stats count by rule user severity risk_score | sort - count"},"name":"Diagnostic Imaging"},"ds_lyCjku4B":{"type":"ds.search","options":{"queryParameters":{"earliest":"-24h@h","latest":"now"},"query":"index=alerts | fillnull | rename source as rule | stats sum(risk_score) as \"risk score\" values(rule) as rules by user | sort - \"risk score\""},"name":"Clinical Exam"},"ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=signals user=$token_user$\n| stats count"},"name":"Average Wait Time"},"ds_0Rt99YYY":{"type":"ds.search","options":{"queryParameters":{"earliest":"-24h@h","latest":"now"},"query":"index=alerts \n| stats dc(user)"},"name":"Search_1"},"ds_Ixiq9nvV_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=* \n| stats count"},"name":"Average Discharge"},"ds_V0OUeNEF_ds_0Rt99YYY":{"type":"ds.search","options":{"queryParameters":{"earliest":"-24h@h","latest":"now"},"query":"index=alerts\n| stats dc(host)"},"name":"Copy of Search_1"},"ds_hPbh0anu_ds_V0OUeNEF_ds_0Rt99YYY":{"type":"ds.search","options":{"queryParameters":{"earliest":"-24h@h","latest":"now"},"query":"index=alerts \n| stats dc(source)"},"name":"Copy of Copy of Search_1"},"ds_42O6TeFY_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts user=$token_user$\n| stats count"},"name":"Copy of Average Wait Time"},"ds_8wGK1wf6_ds_42O6TeFY_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=incidents \n| stats count"},"name":"Copy of Copy of Average Wait Time"},"ds_52kqP7no":{"type":"ds.search","options":{"queryParameters":{"earliest":"-24h@h","latest":"now"},"query":"| makeresults \n| eval value=\"36\" \n| table value"},"name":"Gauge"},"ds_fN8spe8s_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=signals\n| stats count"},"name":"Copy of Average Wait Time"},"ds_rE6Du7O0_ds_JhEHlFy5_ds_sHUvoDKE_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=* \n|  stats count"},"name":"Copy of Admission Time"},"ds_8Ysd2heB_ds_fN8spe8s_ds_kYoaiRUv_ds_Ui7HgXoq":{"type":"ds.search","options":{"query":"index=alerts \n| stats count"},"name":"Copy of Copy of Average Wait Time"},"ds_dzifVa29_ds_LIRVs8HJ":{"type":"ds.search","options":{"query":"index=signals user=$token_user$ | fillnull | rename source as rule | stats count by rule user severity risk_score | sort - count"},"name":"Copy of Diagnostic Imaging"},"ds_Ass1Td1P":{"type":"ds.search","options":{"queryParameters":{"earliest":"-30d@d","latest":"now"},"query":"index=alerts user=$token_user$\n|  timechart count"},"name":"Search_2"}},"inputs":{"input_OtPymaGy":{"options":{"defaultValue":"user","token":"token_user"},"title":"User","type":"input.text"}},"layout":{"type":"absolute","options":{"width":1920,"display":"auto-scale","backgroundColor":"#111215","backgroundImage":{"src":"/en-US/static/app/splunk-dashboard-app/images/examples-hub/healthcare_dashboard/Background.png","x":0,"y":0,"sizeType":"contain"},"height":1080},"structure":[{"item":"viz_XpNIREXZ","type":"block","position":{"x":1060,"y":380,"w":830,"h":690}},{"item":"viz_wgHQmxHz","type":"block","position":{"x":30,"y":110,"w":300,"h":140}},{"item":"viz_HBndDcC8","type":"block","position":{"x":340,"y":110,"w":300,"h":140}},{"item":"viz_vPNP9DGA","type":"block","position":{"x":30,"y":30,"w":680,"h":60}},{"item":"viz_trxVvFuq","type":"block","position":{"x":1070,"y":390,"w":810,"h":670}},{"item":"viz_HVakKuF4","type":"block","position":{"x":50,"y":110,"w":290,"h":50}},{"item":"viz_2hzTTzmg","type":"block","position":{"x":100,"y":150,"w":150,"h":100}},{"item":"viz_dqiBE1n6","type":"block","position":{"x":360,"y":110,"w":220,"h":50}},{"item":"viz_HJSvzC9V","type":"block","position":{"x":400,"y":150,"w":170,"h":100}},{"item":"viz_SFmd93VH","type":"block","position":{"x":1070,"y":320,"w":800,"h":60}},{"item":"viz_6jDDhnpN","type":"block","position":{"x":20,"y":380,"w":830,"h":690}},{"item":"viz_92624TGo","type":"block","position":{"x":30,"y":390,"w":810,"h":670}},{"item":"viz_RAf7HqQX","type":"block","position":{"x":30,"y":320,"w":800,"h":60}},{"item":"viz_IHs7L0T4","type":"block","position":{"x":1020,"y":110,"w":860,"h":140}},{"item":"viz_kLinhZzt","type":"block","position":{"x":1030,"y":110,"w":220,"h":50}},{"item":"viz_LMIiUGeq","type":"block","position":{"x":1020,"y":110,"w":860,"h":140}}],"globalInputs":["input_OtPymaGy"]},"defaults":{"visualizations":{"global":{"showLastUpdated":false}}},"description":"","title":"User Analytics"}]]></definition>
+            <assets><![CDATA[{}]]></assets>
+        </dashboard>
\ No newline at end of file