{
    "title": "Formal User Access Patterns",
    "description": "",
    "widgets": [
        {
            "id": 8667123922341871,
            "definition": {
                "title": "",
                "show_title": true,
                "type": "group",
                "layout_type": "ordered",
                "widgets": [
                    {
                        "id": 4821077344682647,
                        "definition": {
                            "type": "note",
                            "content": "# Formal Connector User Access Patterns\n\nThis dashboard is a sample of the kinds of insights you can leverage in Formal based on our Datadog log integration, particularly for SQL-based technologies.",
                            "background_color": "transparent",
                            "font_size": "12",
                            "text_align": "left",
                            "vertical_align": "top",
                            "show_tick": false,
                            "tick_pos": "50%",
                            "tick_edge": "left",
                            "has_padding": false
                        },
                        "layout": {
                            "x": 0,
                            "y": 0,
                            "width": 12,
                            "height": 2
                        }
                    }
                ]
            },
            "layout": {
                "x": 0,
                "y": 0,
                "width": 12,
                "height": 3
            }
        },
        {
            "id": 2267869278941132,
            "definition": {
                "title": "User Access By Resource",
                "background_color": "vivid_green",
                "show_title": true,
                "type": "group",
                "layout_type": "ordered",
                "widgets": [
                    {
                        "id": 2787607252674776,
                        "definition": {
                            "title": "User Requests By Resource",
                            "type": "toplist",
                            "requests": [
                                {
                                    "queries": [
                                        {
                                            "name": "query1",
                                            "data_source": "logs",
                                            "search": {
                                                "query": "@source:connector @event_type:request"
                                            },
                                            "indexes": [
                                                "*"
                                            ],
                                            "group_by": [
                                                {
                                                    "facet": "@resource.name",
                                                    "limit": 50,
                                                    "sort": {
                                                        "aggregation": "count",
                                                        "order": "desc",
                                                        "metric": "count"
                                                    },
                                                    "should_exclude_missing": true
                                                },
                                                {
                                                    "facet": "@user.formal.end_user.name",
                                                    "limit": 50,
                                                    "sort": {
                                                        "aggregation": "count",
                                                        "order": "desc",
                                                        "metric": "count"
                                                    },
                                                    "should_exclude_missing": true
                                                }
                                            ],
                                            "compute": {
                                                "aggregation": "count"
                                            },
                                            "storage": "hot"
                                        }
                                    ],
                                    "response_format": "scalar",
                                    "formulas": [
                                        {
                                            "formula": "query1"
                                        }
                                    ],
                                    "sort": {
                                        "count": 10,
                                        "order_by": [
                                            {
                                                "type": "formula",
                                                "index": 0,
                                                "order": "desc"
                                            }
                                        ]
                                    }
                                }
                            ],
                            "style": {
                                "display": {
                                    "type": "stacked",
                                    "legend": "automatic"
                                },
                                "palette": "datadog16"
                            }
                        },
                        "layout": {
                            "x": 0,
                            "y": 0,
                            "width": 6,
                            "height": 5
                        }
                    },
                    {
                        "id": 8113746806699161,
                        "definition": {
                            "title": "User Sessions By Resource",
                            "type": "toplist",
                            "requests": [
                                {
                                    "queries": [
                                        {
                                            "name": "query1",
                                            "data_source": "logs",
                                            "search": {
                                                "query": "@source:connector @event_type:session-login -@event_type:session-login-failed"
                                            },
                                            "indexes": [
                                                "*"
                                            ],
                                            "group_by": [
                                                {
                                                    "facet": "@resource.name",
                                                    "limit": 50,
                                                    "sort": {
                                                        "aggregation": "count",
                                                        "order": "desc",
                                                        "metric": "count"
                                                    },
                                                    "should_exclude_missing": true
                                                },
                                                {
                                                    "facet": "@user.formal.end_user.name",
                                                    "limit": 50,
                                                    "sort": {
                                                        "aggregation": "count",
                                                        "order": "desc",
                                                        "metric": "count"
                                                    },
                                                    "should_exclude_missing": true
                                                }
                                            ],
                                            "compute": {
                                                "aggregation": "count"
                                            },
                                            "storage": "hot"
                                        }
                                    ],
                                    "response_format": "scalar",
                                    "formulas": [
                                        {
                                            "formula": "query1"
                                        }
                                    ],
                                    "sort": {
                                        "count": 10,
                                        "order_by": [
                                            {
                                                "type": "formula",
                                                "index": 0,
                                                "order": "desc"
                                            }
                                        ]
                                    }
                                }
                            ],
                            "style": {
                                "display": {
                                    "type": "stacked",
                                    "legend": "automatic"
                                },
                                "palette": "datadog16"
                            }
                        },
                        "layout": {
                            "x": 6,
                            "y": 0,
                            "width": 6,
                            "height": 5
                        }
                    }
                ]
            },
            "layout": {
                "x": 0,
                "y": 3,
                "width": 12,
                "height": 6
            }
        },
        {
            "id": 3072922202135166,
            "definition": {
                "title": "User Access of Datastores",
                "background_color": "vivid_pink",
                "show_title": true,
                "type": "group",
                "layout_type": "ordered",
                "widgets": [
                    {
                        "id": 8526702829717011,
                        "definition": {
                            "title": "Formal User Access By Table",
                            "title_size": "16",
                            "title_align": "left",
                            "type": "toplist",
                            "requests": [
                                {
                                    "queries": [
                                        {
                                            "name": "query1",
                                            "data_source": "logs",
                                            "search": {
                                                "query": "@source:connector @event_type:request"
                                            },
                                            "indexes": [
                                                "*"
                                            ],
                                            "group_by": {
                                                "fields": [
                                                    "@response.datastore.returned_columns.table_path",
                                                    "@user.formal.end_user.name"
                                                ],
                                                "limit": 100,
                                                "sort": {
                                                    "aggregation": "count",
                                                    "metric": "count",
                                                    "order": "desc"
                                                }
                                            },
                                            "compute": {
                                                "aggregation": "count"
                                            },
                                            "storage": "hot"
                                        }
                                    ],
                                    "response_format": "scalar",
                                    "formulas": [
                                        {
                                            "formula": "query1"
                                        }
                                    ],
                                    "sort": {
                                        "count": 100,
                                        "order_by": [
                                            {
                                                "type": "formula",
                                                "index": 0,
                                                "order": "desc"
                                            }
                                        ]
                                    }
                                }
                            ],
                            "style": {
                                "display": {
                                    "type": "stacked",
                                    "legend": "automatic"
                                },
                                "palette": "red"
                            }
                        },
                        "layout": {
                            "x": 0,
                            "y": 0,
                            "width": 6,
                            "height": 6
                        }
                    },
                    {
                        "id": 3156137687232282,
                        "definition": {
                            "title": "Top SQL Queries",
                            "title_size": "16",
                            "title_align": "left",
                            "type": "toplist",
                            "requests": [
                                {
                                    "queries": [
                                        {
                                            "name": "query1",
                                            "data_source": "logs",
                                            "search": {
                                                "query": "@source:connector @event_type:request"
                                            },
                                            "indexes": [
                                                "*"
                                            ],
                                            "group_by": {
                                                "fields": [
                                                    "@request.query.normalized"
                                                ],
                                                "limit": 50,
                                                "sort": {
                                                    "aggregation": "count",
                                                    "metric": "count",
                                                    "order": "desc"
                                                }
                                            },
                                            "compute": {
                                                "aggregation": "count"
                                            },
                                            "storage": "hot"
                                        }
                                    ],
                                    "response_format": "scalar",
                                    "formulas": [
                                        {
                                            "formula": "query1"
                                        }
                                    ],
                                    "sort": {
                                        "count": 50,
                                        "order_by": [
                                            {
                                                "type": "formula",
                                                "index": 0,
                                                "order": "desc"
                                            }
                                        ]
                                    }
                                }
                            ],
                            "style": {
                                "display": {
                                    "type": "stacked",
                                    "legend": "automatic"
                                },
                                "palette": "red"
                            }
                        },
                        "layout": {
                            "x": 6,
                            "y": 0,
                            "width": 6,
                            "height": 6
                        }
                    }
                ]
            },
            "layout": {
                "x": 0,
                "y": 9,
                "width": 12,
                "height": 7
            }
        },
        {
            "id": 6720897888608265,
            "definition": {
                "title": "User Access of PII",
                "background_color": "vivid_purple",
                "show_title": true,
                "type": "group",
                "layout_type": "ordered",
                "widgets": [
                    {
                        "id": 8421382561983120,
                        "definition": {
                            "title": "User Access of PII Labels",
                            "title_size": "16",
                            "title_align": "left",
                            "time": {},
                            "type": "toplist",
                            "requests": [
                                {
                                    "queries": [
                                        {
                                            "name": "query1",
                                            "data_source": "logs",
                                            "search": {
                                                "query": "@source:connector @event_type:request"
                                            },
                                            "indexes": [
                                                "*"
                                            ],
                                            "group_by": {
                                                "fields": [
                                                    "@response.datastore.returned_columns.data_label"
                                                ],
                                                "limit": 50,
                                                "sort": {
                                                    "aggregation": "count",
                                                    "metric": "count",
                                                    "order": "desc"
                                                }
                                            },
                                            "compute": {
                                                "aggregation": "count"
                                            },
                                            "storage": "hot"
                                        }
                                    ],
                                    "response_format": "scalar",
                                    "formulas": [
                                        {
                                            "formula": "query1"
                                        }
                                    ],
                                    "sort": {
                                        "count": 10,
                                        "order_by": [
                                            {
                                                "type": "formula",
                                                "index": 0,
                                                "order": "desc"
                                            }
                                        ]
                                    }
                                }
                            ],
                            "style": {
                                "display": {
                                    "type": "stacked",
                                    "legend": "automatic"
                                },
                                "palette": "purple"
                            }
                        },
                        "layout": {
                            "x": 0,
                            "y": 0,
                            "width": 6,
                            "height": 6
                        }
                    },
                    {
                        "id": 3872874997746571,
                        "definition": {
                            "title": "User Access of PII Labels by User",
                            "title_size": "16",
                            "title_align": "left",
                            "type": "toplist",
                            "requests": [
                                {
                                    "queries": [
                                        {
                                            "name": "query1",
                                            "data_source": "logs",
                                            "search": {
                                                "query": "@source:connector @event_type:request"
                                            },
                                            "indexes": [
                                                "*"
                                            ],
                                            "group_by": {
                                                "fields": [
                                                    "@response.datastore.returned_columns.data_label",
                                                    "@user.formal.end_user.name"
                                                ],
                                                "limit": 50,
                                                "sort": {
                                                    "aggregation": "count",
                                                    "metric": "count",
                                                    "order": "desc"
                                                }
                                            },
                                            "compute": {
                                                "aggregation": "count"
                                            },
                                            "storage": "hot"
                                        }
                                    ],
                                    "response_format": "scalar",
                                    "formulas": [
                                        {
                                            "formula": "query1"
                                        }
                                    ],
                                    "sort": {
                                        "count": 10,
                                        "order_by": [
                                            {
                                                "type": "formula",
                                                "index": 0,
                                                "order": "desc"
                                            }
                                        ]
                                    }
                                }
                            ],
                            "style": {
                                "display": {
                                    "type": "stacked",
                                    "legend": "automatic"
                                },
                                "palette": "purple"
                            }
                        },
                        "layout": {
                            "x": 6,
                            "y": 0,
                            "width": 6,
                            "height": 6
                        }
                    }
                ]
            },
            "layout": {
                "x": 0,
                "y": 16,
                "width": 12,
                "height": 7
            }
        }
    ],
    "template_variables": [],
    "layout_type": "ordered",
    "notify_list": [],
    "pause_auto_refresh": false,
    "reflow_type": "fixed"
}