{
  "title": "AgenTrux Audit Logs",
  "description": "AgenTrux audit-log export overview. Prerequisite: create facets @ocsf.activity_name / @ocsf.actor.user.uid / @ocsf.status (see https://docs.agentrux.com/datadog.html). Filter: service:agentrux",
  "layout_type": "ordered",
  "reflow_type": "auto",
  "template_variables": [
    {
      "name": "service",
      "prefix": "service",
      "default": "agentrux"
    }
  ],
  "widgets": [
    {
      "definition": {
        "title": "Audit events (24h)",
        "type": "query_value",
        "precision": 0,
        "requests": [
          {
            "response_format": "scalar",
            "formulas": [{ "formula": "query1" }],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service" },
                "group_by": []
              }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Failed operations (24h)",
        "type": "query_value",
        "precision": 0,
        "requests": [
          {
            "response_format": "scalar",
            "formulas": [{ "formula": "query1" }],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service status:error" },
                "group_by": []
              }
            ],
            "conditional_formats": [
              { "comparator": ">", "value": 0, "palette": "white_on_red" },
              { "comparator": "<=", "value": 0, "palette": "white_on_green" }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Activity over time (by operation)",
        "type": "timeseries",
        "show_legend": true,
        "legend_layout": "horizontal",
        "requests": [
          {
            "response_format": "timeseries",
            "display_type": "bars",
            "formulas": [{ "formula": "query1" }],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service" },
                "group_by": [
                  {
                    "facet": "@ocsf.activity_name",
                    "limit": 8,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Failures over time",
        "type": "timeseries",
        "show_legend": false,
        "requests": [
          {
            "response_format": "timeseries",
            "display_type": "bars",
            "style": { "palette": "warm" },
            "formulas": [{ "formula": "query1" }],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service status:error" },
                "group_by": [
                  {
                    "facet": "@ocsf.activity_name",
                    "limit": 5,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Top actors",
        "type": "toplist",
        "requests": [
          {
            "response_format": "scalar",
            "formulas": [
              { "formula": "query1", "limit": { "count": 10, "order": "desc" } }
            ],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service" },
                "group_by": [
                  {
                    "facet": "@ocsf.actor.user.uid",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Top operations",
        "type": "toplist",
        "requests": [
          {
            "response_format": "scalar",
            "formulas": [
              { "formula": "query1", "limit": { "count": 10, "order": "desc" } }
            ],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service" },
                "group_by": [
                  {
                    "facet": "@ocsf.activity_name",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Authentication activity (OCSF class 3002)",
        "type": "timeseries",
        "show_legend": true,
        "legend_layout": "horizontal",
        "requests": [
          {
            "response_format": "timeseries",
            "display_type": "bars",
            "formulas": [{ "formula": "query1" }],
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "search": { "query": "$service @ocsf.class_uid:3002" },
                "group_by": [
                  {
                    "facet": "@ocsf.status",
                    "limit": 2,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Recent failures",
        "type": "log_stream",
        "indexes": [],
        "query": "$service status:error",
        "sort": { "column": "time", "order": "desc" },
        "columns": ["service"],
        "show_date_column": true,
        "show_message_column": true,
        "message_display": "expanded-md"
      }
    }
  ]
}