{
  "__inputs": [
    {
      "description": "Flux datasource",
      "label": "InfluxDB (Flux)",
      "name": "DS_INFLUXDB_FLUX",
      "pluginId": "influxdb",
      "pluginName": "InfluxDB",
      "type": "datasource"
    }
  ],
  "id": null,
  "panels": [
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "fieldConfig": {
        "defaults": {
          "custom": {
            "drawStyle": "bars",
            "stacking": {
              "mode": "normal"
            }
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "pass"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "green",
                  "mode": "fixed"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "fail"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 0
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"pass\")\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> yield(name: \"pass\")",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"fail\")\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> yield(name: \"fail\")",
          "refId": "B"
        }
      ],
      "title": "DMARC Pass vs Fail",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 12,
        "y": 0
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"disposition\"])\n  |> sum()\n  |> yield(name: \"disposition\")",
          "refId": "A"
        }
      ],
      "title": "Total Messages by Disposition",
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "gridPos": {
        "h": 8,
        "w": 6,
        "x": 18,
        "y": 0
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"org_name\"])\n  |> sum()\n  |> yield(name: \"orgs\")",
          "refId": "A"
        }
      ],
      "title": "Messages by Reporting Org",
      "type": "piechart"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "fieldConfig": {
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "pass"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "green",
                  "mode": "fixed"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "fail"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"policy_dkim\"])\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> yield(name: \"dkim\")",
          "refId": "A"
        }
      ],
      "title": "DKIM Results Over Time",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "fieldConfig": {
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "pass"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "green",
                  "mode": "fixed"
                }
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "fail"
            },
            "properties": [
              {
                "id": "color",
                "value": {
                  "fixedColor": "red",
                  "mode": "fixed"
                }
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 8
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"policy_spf\"])\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> yield(name: \"spf\")",
          "refId": "A"
        }
      ],
      "title": "SPF Results Over Time",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 16
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"domain\"])\n  |> aggregateWindow(every: 1d, fn: sum, createEmpty: false)\n  |> yield(name: \"domains\")",
          "refId": "A"
        }
      ],
      "title": "Message Volume by Domain",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 16
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"source_ip\", \"policy_dkim\", \"policy_spf\", \"disposition\", \"header_from\"])\n  |> sum()\n  |> sort(columns: [\"_value\"], desc: true)\n  |> limit(n: 20)",
          "refId": "A"
        }
      ],
      "title": "Top Source IPs (Potential Spoofing)",
      "transformations": [
        {
          "id": "organize",
          "options": {
            "renameByName": {
              "_value": "Count",
              "disposition": "Disposition",
              "header_from": "From Domain",
              "policy_dkim": "DKIM",
              "policy_spf": "SPF",
              "source_ip": "Source IP"
            }
          }
        }
      ],
      "type": "table"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "fieldConfig": {
        "defaults": {
          "thresholds": {
            "steps": [
              {
                "color": "red",
                "value": null
              },
              {
                "color": "yellow",
                "value": 90
              },
              {
                "color": "green",
                "value": 99
              }
            ]
          },
          "unit": "percent"
        }
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 0,
        "y": 24
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "pass_count = from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"pass\")\n  |> sum()\n  |> findColumn(fn: (key) => true, column: \"_value\")\n\ntotal = from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> sum()\n  |> findColumn(fn: (key) => true, column: \"_value\")\n\nfrom(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"pass\")\n  |> sum()\n  |> map(fn: (r) => ({r with _value: if total[0] > 0 then float(v: pass_count[0]) / float(v: total[0]) * 100.0 else 0.0}))",
          "refId": "A"
        }
      ],
      "title": "DMARC Pass Rate",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 6,
        "y": 24
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> group(columns: [\"report_id\"])\n  |> first()\n  |> group()\n  |> count()",
          "refId": "A"
        }
      ],
      "title": "Total Reports Processed",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 12,
        "y": 24
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"count\")\n  |> sum()",
          "refId": "A"
        }
      ],
      "title": "Total Messages Evaluated",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB_FLUX}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "fixedColor": "red",
            "mode": "fixed"
          },
          "thresholds": {
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 1
              }
            ]
          }
        }
      },
      "gridPos": {
        "h": 4,
        "w": 6,
        "x": 18,
        "y": 24
      },
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB_FLUX}"
          },
          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"dmarc_report\")\n  |> filter(fn: (r) => r._field == \"fail\")\n  |> sum()",
          "refId": "A"
        }
      ],
      "title": "Failed Messages",
      "type": "stat"
    }
  ],
  "refresh": "1h",
  "schemaVersion": 39,
  "tags": [
    "dmarc",
    "email",
    "security"
  ],
  "time": {
    "from": "now-90d",
    "to": "now"
  },
  "timezone": "browser",
  "title": "DMARC Reports"
}