thesabear/public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix dashy-soc-board.md drift (Vault data-sourcing accuracy, Netbox->Proxmox channel, function size)

Browse Source 
Vault panel data was overstated as fully live; only CA cert expiry
actually is - the rest comes from a cached Prometheus query. Slack
channel list still named the decommissioned Netbox app instead of
the real Proxmox channel.
This commit is contained in:
automation-bot committed 2026-09-19 10:49:44 +03:00
1 parent 24df469a09
commit c8c56add40
1 file changed
+4 -4
Download Patch File Download Diff File Expand all files Collapse all files
docs/dashy-soc-board.md
+4 -4
View File
@@ -1,4 +1,4 @@
<!-- verified: 2026-09-06
<!-- verified: 2026-09-19
trilium : 5XjzoVTH1r3B, cVFNSn4CuuEN
-->
@@ -14,10 +14,10 @@ This board didn't start from nothing — it absorbed several formerly-standalone
| Source | What it actually contributes |
|---|---|
| Wazuh indexer | 7-day findings, categorized: ClamAV, vulnerabilities, rootkit/anomaly, authentication, other |
| Vault | Seal state, active lease/token counts, KV engine counts, token TTL distribution, and root/intermediate CA cert expiry — parsed live from Vault's own `pki/cert/ca` and `pki_int/cert/ca` endpoints on every load, not a cached value |
| Vault | Seal state, active lease/token counts, KV engine counts, and token TTL distribution — read from Prometheus metrics, not a live Vault call, so all of them go stale together if the metrics-reader token lapses. Root/intermediate CA cert expiry is the one exception, parsed live from Vault's own `pki/cert/ca` and `pki_int/cert/ca` endpoints on every load regardless of metrics health |
| Technitium DNS | Query stats, top clients/domains, blocklist state, plus a dedicated "DNS Security Signals" section: forwarder failures (read from the Loki-shipped query log), query-log ingestion lag, next blocklist update time |
| Fleet config-drift audit | *Not* computed by this board's own function — read from Node-RED's shared `fleetAudit` global, populated by a separate ingestion process, covering 4 finding types: untracked stacks, missing declared directories, containers stuck in `Created`, and TZ drift |
| Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Netbox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
| Slack | 12 app-specific channels (the *arr suite, Jellyfin/Emby/Seerr, Kopia, Authentik, Gitea, Proxmox, Grafana) mapped to their owning host by a plain lookup table, plus each host's own alert channel |
| Proxmox `cluster/resources` API | The two hypervisor nodes' own CPU/RAM/disk (no Prometheus coverage on bare metal) plus the full running VM/LXC tree per node |
The fourteen, enumerated directly from the function's own upstream-URL constants rather than counted by hand — this is the actual grep and its real output, not a reconstruction:
@@ -48,7 +48,7 @@ for n in data:
if n.get('type') == 'function' and n.get('name') == 'Build SOC Board HTML':
print(n['name'], '->', len(n['func']), 'chars')
"
Build SOC Board HTML -> 104443 chars
Build SOC Board HTML -> 104635 chars
```
## Why One Function Instead of Native Dashy Widgets