Use the Grafana Plug-In

Enable log data export from Radiant Security to Grafana to create custom dashboards and visualizations.

In this guide, you will use the Grafana plug-in to query Radiant Security’s Log Management data from Grafana. This allows you to build custom dashboards, visualizations, and analytics for deeper insights into your logs.

Requirements

• To enable to plug-in, a Grafana instance must be installed in your local or virtual environment.

Note: The Grafana plug-in does not currently support Grafana Cloud.

Configure the data connector in Radiant Security

1. Log in to Radiant Security.

2. From the navigation menu, click Settings > Data Connectors and click + Add Connector.

3. Search for and select the Radiant Security Grafana Plug-In option from the list and then click Data Feeds.

4. Under Select your data feeds, select Radiant Security Grafana Plug-In and click Credentials.

5. Under Credential Name, give the credential an identifiable name (e.g. RS-Grafana).

6. Under Required Credentials, in the Connector tag field enter a value. This value will act as the salt to randomize the unique Token you’ll download in the next step.

7. Click Add Connector.

8. Copy and save the connector Token value using the clipboard option or download the Token file. You will need this token to complete the configuration.

9. Click Done to save your changes.

Install the Grafana plug-in

On request, we’ll provide you with a zip file containing the Grafana plug-in. The plug-in is private and unsigned, so it requires some modifications in order to enable installation.

1. Install Grafana on a local server or virtual machine.

2. Find the configuration file named grafana.ini. The file location is specific to your operating system. Refer to the Configure Grafana document for more information.

3. In the grafana.ini file, set the following to allow Radiant Security's unsigned plug-in to load:

   allow_loading_unsigned_plugins = radiantsecurity-radiantsecurity-datasource

4. Extract the plug-in into the Grafana plug-ins directory:

   var/lib/grafana/plugins/radiantsecurity-datasource

   The full directory path may differ depending on operating system and Grafana installation method. For installation on MacOS, the full path for a Homebrew installation is:

   /opt/homebrew/var/lib/grafana/plugins/radiantsecurity-datasource

5. Restart Grafana. If you're using Homebrew on macOS, run the following command:

   brew services restart grafana

6. Optional: Verify the settings in Grafana by navigating to Administration > General > Settings.

   1. paths > plugins points to the parent directory of radiantsecurity-datasource where the plug-in has been extracted

   2. plugins > allow_loading_unsigned_plugins is set to radiantsecurity-radiantsecurity-datasource

Create a data source

1. In Grafana, create a new data source with the plug-in in Grafana by navigating to Administration > Plugins and data. Search for Radiant Security and the plug-in will appear.

1. Click Save & test. The plug-in is now available as a data source and can be seen in Connections > Data source.

2. Click the plug-in. Ignore the warning that the plug-in is unsigned and not published. Click the Add new data sources button.

3. For Name, enter a name for the plug-in.

4. For API Key, enter the Token that you created and copied from the first step Configure the data connector in Radiant Security.

Create a Grafana dashboard and visualization

Create a new dashboard in Grafana to display a log volume histogram for all connectors.

1. In the main menu in Grafana, click Dashboards.

2. On the Dashboards page, click New and select New Dashboard from the drop-down menu.

3. Click + Add visualization.

4. Select the data source that was just created with the plug-in.

5. The visualization will default to a Time series from the top right pull-down menu.

6. To test the visualization, enter a wildcard query * in the Lucene Query field. This should populate the graph with aggregated data representing all received logs over the last six hours. If needed, you can adjust the time range accordingly.

7. Add a Group By field by clicking the + at the end of the Group By row.

8. Select rs_connectorType to be the first Group By criteria. Click Refresh to see the new set of data which should include disaggregated log types.

9. In the right panel, configure the legend and title by applying the following modifications:

   1. Title: Connectors with Log Volume

   2. Legend Mode: Table

   3. Legend Placement: Right

   4. Legend Values: Total

   5. Axis Scale: Logarithmic (assuming multiple log sources with a wide range of volume)

   6. Log Base: 10

10. Click Save Dashboard to save the changes and exit to the dashboard view. The new dashboard should look similar to the image below.