Grafana Dashboards

Grafana Dashboards

Overview

SecuSiem uses Grafana OSS for log visualization, alerting, and dashboard management. Each tenant has an isolated Grafana organization with its own dashboards and datasource.

Grafana Configuration

Access

• Dev URL: Internal via ClusterIP service in secusiem-monitoring namespace
• Port: 80 (mapped from container port 3000)
• Default credentials: admin / configured via secrets

Datasource

Pre-configured Loki datasource:

datasources:
  - name: Loki
    type: loki
    access: proxy
    url: http://loki-gateway.secusiem-loki.svc.cluster.local
    isDefault: true
    jsonData:
      maxLines: 1000

For multi-tenant access, each tenant's Grafana organization has its own Loki datasource configured with the appropriate X-Scope-OrgID header.

Planned Dashboards

Security Overview Dashboard

Key panels:

• Alert timeline: Line chart of alerts over time by severity
• Top threats: Bar chart of most frequent detection rules
• MITRE ATT&CK heatmap: Matrix visualization of tactic/technique coverage
• Active alerts: Table of unresolved alerts with severity badges
• Log volume: Area chart of ingested log volume (MB/day)

Log Explorer

• Full-text log search with label filters
• Real-time log streaming (tail mode)
• JSON log parsing and field extraction
• Time range selection

Tenant Usage Dashboard

• Daily/weekly/monthly log volume trends
• API call counts
• Claude analysis counts
• Storage utilization
• Cost estimation

Security Alerts Dashboard

• Alert list with filtering by severity, rule, and time range
• Alert details with MITRE ATT&CK context
• Resolution tracking
• False positive rate metrics

Alerting (Planned)

Grafana alerting rules will be configured for:

Notification channels: Slack, PagerDuty, Email (via SMTP).

Per-Tenant Grafana Setup

When a new tenant is provisioned, the GrafanaManager automatically:

1. Creates a new Grafana Organization via the admin API
2. Creates a Loki datasource with the tenant's X-Scope-OrgID
3. Provisions default dashboards (Security Overview, Log Explorer)
4. Creates an admin user for the tenant
5. Records the grafana_org_id in the tenant database record