# CrowdSec Grafana Dashboard
# Auto-discovered by Grafana sidecar via grafana_dashboard label
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-dashboard-crowdsec
  namespace: grafana
  labels:
    grafana_dashboard: "1"
data:
  crowdsec-overview.json: |
    {
      "annotations": { "list": [] },
      "editable": true,
      "fiscalYearStartMonth": 0,
      "graphTooltip": 1,
      "links": [],
      "panels": [
        {
          "title": "Active Decisions (Bans)",
          "type": "stat",
          "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "cs_active_decisions",
              "legendFormat": "Active Bans"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "color": { "mode": "thresholds" },
              "thresholds": {
                "steps": [
                  { "color": "green", "value": null },
                  { "color": "yellow", "value": 10 },
                  { "color": "red", "value": 100 }
                ]
              }
            }
          }
        },
        {
          "title": "Total Alerts",
          "type": "stat",
          "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "sum(increase(cs_alerts_total[24h]))",
              "legendFormat": "Alerts (24h)"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "color": { "mode": "thresholds" },
              "thresholds": {
                "steps": [
                  { "color": "green", "value": null },
                  { "color": "yellow", "value": 50 },
                  { "color": "red", "value": 200 }
                ]
              }
            }
          }
        },
        {
          "title": "CAPI Blocklist Entries",
          "type": "stat",
          "gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "cs_active_decisions{origin=\"CAPI\"}",
              "legendFormat": "Community Blocklist"
            }
          ]
        },
        {
          "title": "Bouncer Status",
          "type": "stat",
          "gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "cs_bouncers",
              "legendFormat": "Bouncers"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "color": { "mode": "thresholds" },
              "thresholds": {
                "steps": [
                  { "color": "red", "value": null },
                  { "color": "green", "value": 1 }
                ]
              }
            }
          }
        },
        {
          "title": "Alerts by Scenario (24h)",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 4 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "sum by (scenario) (increase(cs_alerts_total[1h]))",
              "legendFormat": "{{ scenario }}"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "bars", "stacking": { "mode": "normal" } }
            }
          }
        },
        {
          "title": "Parser Hits (24h)",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 4 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "sum by (source) (increase(cs_parser_hits_total[1h]))",
              "legendFormat": "{{ source }}"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "line", "fillOpacity": 10 }
            }
          }
        },
        {
          "title": "Decisions by Origin",
          "type": "piechart",
          "gridPos": { "h": 8, "w": 8, "x": 0, "y": 12 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "cs_active_decisions",
              "legendFormat": "{{ origin }}"
            }
          ]
        },
        {
          "title": "Bucket Overflows (Triggered Scenarios)",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 16, "x": 8, "y": 12 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "sum by (name) (increase(cs_bucket_overflows_total[1h]))",
              "legendFormat": "{{ name }}"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "custom": { "drawStyle": "bars", "stacking": { "mode": "normal" } }
            }
          }
        },
        {
          "title": "Firewall Bouncer - Processed Decisions",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 20 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "sum by (instance) (increase(cs_bouncer_decisions[1h]))",
              "legendFormat": "{{ instance }}"
            }
          ]
        },
        {
          "title": "LAPI Requests",
          "type": "timeseries",
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 20 },
          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
          "targets": [
            {
              "expr": "sum by (method, route) (increase(cs_lapi_requests_total[1h]))",
              "legendFormat": "{{ method }} {{ route }}"
            }
          ]
        }
      ],
      "schemaVersion": 39,
      "tags": ["crowdsec", "security", "zero-trust"],
      "templating": {
        "list": [
          {
            "current": { "selected": false, "text": "Prometheus", "value": "prometheus" },
            "name": "DS_PROMETHEUS",
            "type": "datasource",
            "query": "prometheus"
          }
        ]
      },
      "time": { "from": "now-24h", "to": "now" },
      "title": "CrowdSec Overview",
      "uid": "crowdsec-overview"
    }