{
  "__inputs": [
    {"name": "DS_LOKI", "label": "Loki", "description": "Loki data source for Crawdad logs", "type": "datasource", "pluginId": "loki"},
    {"name": "DS_PROMETHEUS", "label": "Prometheus", "description": "Prometheus data source for Crawdad metrics", "type": "datasource", "pluginId": "prometheus"}
  ],
  "title": "Crawdad AI Agent Security",
  "uid": "crawdad-main",
  "version": 1,
  "schemaVersion": 39,
  "timezone": "browser",
  "refresh": "30s",
  "time": {"from": "now-24h", "to": "now"},
  "templating": {
    "list": [
      {"name": "identity", "type": "query", "datasource": {"type": "loki", "uid": "${DS_LOKI}"}, "query": "{service_name=\"crawdad-sidecar\"} | json | line_format \"{{.identity_id}}\"", "refresh": 2, "includeAll": true, "multi": true, "current": {"text": "All", "value": "$__all"}}
    ]
  },
  "panels": [
    {"id": 1, "title": "Detections (24h)", "type": "stat", "gridPos": {"h": 4, "w": 6, "x": 0, "y": 0}, "targets": [{"expr": "sum(increase(crawdad_detections_total[24h]))", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"color": {"mode": "thresholds"}, "thresholds": {"steps": [{"color": "green", "value": null}, {"color": "yellow", "value": 10}, {"color": "red", "value": 50}]}}}},
    {"id": 2, "title": "Detection Rate (Red Team)", "type": "gauge", "gridPos": {"h": 4, "w": 6, "x": 6, "y": 0}, "targets": [{"expr": "crawdad_redteam_detection_rate", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"min": 0, "max": 1, "unit": "percentunit", "thresholds": {"steps": [{"color": "red", "value": null}, {"color": "yellow", "value": 0.8}, {"color": "green", "value": 0.95}]}}}},
    {"id": 3, "title": "Active Identities", "type": "stat", "gridPos": {"h": 4, "w": 6, "x": 12, "y": 0}, "targets": [{"expr": "crawdad_identities_active", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"color": {"fixedColor": "blue", "mode": "fixed"}}}},
    {"id": 4, "title": "Sensitive Syscalls (24h)", "type": "stat", "gridPos": {"h": 4, "w": 6, "x": 18, "y": 0}, "targets": [{"expr": "sum(increase(crawdad_syscalls_sensitive[24h]))", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"color": {"mode": "thresholds"}, "thresholds": {"steps": [{"color": "green", "value": null}, {"color": "red", "value": 1}]}}}},

    {"id": 10, "title": "Detections over Time", "type": "timeseries", "gridPos": {"h": 8, "w": 12, "x": 0, "y": 4}, "targets": [{"expr": "sum by (category) (rate(crawdad_detections_total[5m]))", "legendFormat": "{{category}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"custom": {"fillOpacity": 30, "stacking": {"mode": "normal"}}}}},
    {"id": 11, "title": "Scan Latency (p50/p95/p99)", "type": "timeseries", "gridPos": {"h": 8, "w": 12, "x": 12, "y": 4}, "targets": [{"expr": "histogram_quantile(0.50, rate(crawdad_scan_duration_ms_bucket[5m]))", "legendFormat": "p50", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}, {"expr": "histogram_quantile(0.95, rate(crawdad_scan_duration_ms_bucket[5m]))", "legendFormat": "p95"}, {"expr": "histogram_quantile(0.99, rate(crawdad_scan_duration_ms_bucket[5m]))", "legendFormat": "p99"}]},

    {"id": 20, "title": "Detections by Category", "type": "piechart", "gridPos": {"h": 8, "w": 8, "x": 0, "y": 12}, "targets": [{"expr": "sum by (category) (increase(crawdad_detections_total[24h]))", "legendFormat": "{{category}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}]},
    {"id": 21, "title": "Detections by Layer", "type": "barchart", "gridPos": {"h": 8, "w": 8, "x": 8, "y": 12}, "targets": [{"expr": "sum by (layer) (increase(crawdad_detections_total[24h]))", "legendFormat": "{{layer}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}]},
    {"id": 22, "title": "Top Patterns", "type": "table", "gridPos": {"h": 8, "w": 8, "x": 16, "y": 12}, "targets": [{"expr": "topk(10, sum by (signature) (increase(crawdad_detections_total[24h])))", "format": "table", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}]},

    {"id": 30, "title": "Agent Identities", "type": "table", "gridPos": {"h": 8, "w": 12, "x": 0, "y": 20}, "targets": [{"expr": "{service_name=\"crawdad-sidecar\", event_type=\"identity_summary\"} | json", "datasource": {"type": "loki", "uid": "${DS_LOKI}"}}]},
    {"id": 31, "title": "Agent Activity", "type": "timeseries", "gridPos": {"h": 8, "w": 12, "x": 12, "y": 20}, "targets": [{"expr": "sum by (identity) (rate(crawdad_detections_total{identity=~\"$identity\"}[5m]))", "legendFormat": "{{identity}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}]},

    {"id": 40, "title": "Anomalies by Severity", "type": "timeseries", "gridPos": {"h": 8, "w": 12, "x": 0, "y": 28}, "targets": [{"expr": "sum by (severity) (rate(crawdad_anomalies_total[5m]))", "legendFormat": "{{severity}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"custom": {"fillOpacity": 20}}}},
    {"id": 41, "title": "Recent High-Severity Anomalies", "type": "table", "gridPos": {"h": 8, "w": 12, "x": 12, "y": 28}, "targets": [{"expr": "{service_name=\"crawdad-sidecar\", event_type=\"anomaly\", severity=~\"high|critical\"} | json", "datasource": {"type": "loki", "uid": "${DS_LOKI}"}}]},

    {"id": 50, "title": "Red Team Detection Rate", "type": "timeseries", "gridPos": {"h": 8, "w": 12, "x": 0, "y": 36}, "targets": [{"expr": "crawdad_redteam_detection_rate", "legendFormat": "Overall", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"min": 0, "max": 1, "unit": "percentunit"}}},
    {"id": 51, "title": "Red Team by Category", "type": "barchart", "gridPos": {"h": 8, "w": 12, "x": 12, "y": 36}, "targets": [{"expr": "crawdad_redteam_detection_rate_by_category", "legendFormat": "{{category}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}]},

    {"id": 60, "title": "Component Health", "type": "stat", "gridPos": {"h": 4, "w": 24, "x": 0, "y": 44}, "targets": [{"expr": "crawdad_uptime_seconds", "legendFormat": "Uptime", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}], "fieldConfig": {"defaults": {"unit": "s"}}},
    {"id": 61, "title": "Error Rate", "type": "timeseries", "gridPos": {"h": 8, "w": 24, "x": 0, "y": 48}, "targets": [{"expr": "sum by (component) (rate(crawdad_errors_total[5m]))", "legendFormat": "{{component}}", "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"}}]}
  ]
}