openclaw-grafana-lens
Version:
OpenClaw plugin that gives AI agents full Grafana access — 18 composable tools for PromQL/LogQL/TraceQL queries, dashboard creation, alerting, SRE investigation, security monitoring, data collection pipeline management via Grafana Alloy (29 recipes), and
411 lines (410 loc) • 17.1 kB
JSON
{
"title": "Security Overview",
"description": "Security monitoring — prompt injection signals, session anomalies, tool error classification, webhook errors, cost spikes, and gateway lifecycle. Part of the OpenClaw Grafana Lens observability suite.",
"tags": ["openclaw", "grafana-lens", "security-overview"],
"timezone": "browser",
"editable": true,
"schemaVersion": 39,
"time": { "from": "now-6h", "to": "now" },
"refresh": "30s",
"links": [
{
"title": "SRE Operations",
"tags": ["openclaw", "grafana-lens", "sre-operations"],
"type": "dashboards",
"asDropdown": false,
"icon": "external link"
},
{
"title": "LLM Command Center",
"tags": ["openclaw", "grafana-lens", "command-center"],
"type": "dashboards",
"asDropdown": false,
"icon": "external link"
},
{
"title": "OpenClaw Dashboards",
"tags": ["openclaw", "grafana-lens"],
"type": "dashboards",
"asDropdown": true,
"icon": "external link"
}
],
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": { "type": "grafana", "uid": "-- Grafana --" },
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
]
},
"templating": {
"list": [
{
"name": "prometheus",
"label": "Prometheus",
"type": "datasource",
"query": "prometheus",
"current": {},
"hide": 0
},
{
"name": "loki",
"label": "Loki",
"type": "datasource",
"query": "loki",
"current": {},
"hide": 0
}
]
},
"panels": [
{
"id": 1,
"title": "── Threat Summary ──",
"type": "row",
"collapsed": false,
"gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }
},
{
"id": 2,
"title": "Prompt Injection Signals (1h)",
"description": "Prompt injection patterns detected in user input + tool loop signals in the last hour",
"type": "stat",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 4, "w": 6, "x": 0, "y": 1 },
"fieldConfig": {
"defaults": {
"thresholds": {
"mode": "absolute",
"steps": [
{ "color": "green", "value": null },
{ "color": "yellow", "value": 1 },
{ "color": "red", "value": 5 }
]
},
"noValue": "0"
}
},
"targets": [
{
"refId": "A",
"expr": "sum(increase(openclaw_lens_prompt_injection_signals_total[1h])) or vector(0)",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
],
"options": { "reduceOptions": { "calcs": ["lastNotNull"] }, "colorMode": "background" }
},
{
"id": 3,
"title": "Active Tool Loops",
"description": "Sessions currently stuck in tool loops — a strong prompt injection indicator",
"type": "stat",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 4, "w": 6, "x": 6, "y": 1 },
"fieldConfig": {
"defaults": {
"thresholds": {
"mode": "absolute",
"steps": [
{ "color": "green", "value": null },
{ "color": "yellow", "value": 1 },
{ "color": "red", "value": 3 }
]
},
"noValue": "0"
}
},
"targets": [
{
"refId": "A",
"expr": "sum(openclaw_lens_tool_loops_active) or vector(0)",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
],
"options": { "reduceOptions": { "calcs": ["lastNotNull"] }, "colorMode": "background" }
},
{
"id": 4,
"title": "Gateway Restarts (24h)",
"description": "Gateway process restarts in the last 24 hours — may indicate unauthorized access or instability",
"type": "stat",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 4, "w": 6, "x": 12, "y": 1 },
"fieldConfig": {
"defaults": {
"thresholds": {
"mode": "absolute",
"steps": [
{ "color": "green", "value": null },
{ "color": "yellow", "value": 3 },
{ "color": "red", "value": 10 }
]
},
"noValue": "0"
}
},
"targets": [
{
"refId": "A",
"expr": "sum(increase(openclaw_lens_gateway_restarts_total[24h])) or vector(0)",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
],
"options": { "reduceOptions": { "calcs": ["lastNotNull"] }, "colorMode": "background" }
},
{
"id": 5,
"title": "Stuck Sessions",
"description": "Number of currently stuck sessions — sessions not making progress",
"type": "stat",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 4, "w": 6, "x": 18, "y": 1 },
"fieldConfig": {
"defaults": {
"thresholds": {
"mode": "absolute",
"steps": [
{ "color": "green", "value": null },
{ "color": "yellow", "value": 1 },
{ "color": "red", "value": 3 }
]
},
"noValue": "0"
}
},
"targets": [
{
"refId": "A",
"expr": "sum(openclaw_lens_sessions_stuck) or vector(0)",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
],
"options": { "reduceOptions": { "calcs": ["lastNotNull"] }, "colorMode": "background" }
},
{
"id": 6,
"title": "── Access & Behavior ──",
"type": "row",
"collapsed": false,
"gridPos": { "h": 1, "w": 24, "x": 0, "y": 5 }
},
{
"id": 7,
"title": "Webhook Error vs Received Rate",
"description": "Webhook error rate overlaid on received rate — high error ratio indicates malformed payloads or signature failures",
"type": "timeseries",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 6 },
"fieldConfig": {
"defaults": { "custom": { "drawStyle": "line", "lineWidth": 2, "fillOpacity": 10 } },
"overrides": [
{
"matcher": { "id": "byName", "options": "Errors" },
"properties": [{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } }]
},
{
"matcher": { "id": "byName", "options": "Received" },
"properties": [{ "id": "color", "value": { "fixedColor": "green", "mode": "fixed" } }]
}
]
},
"targets": [
{
"refId": "A",
"expr": "sum(rate(openclaw_lens_webhook_error_total[5m]))",
"legendFormat": "Errors",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
},
{
"refId": "B",
"expr": "sum(rate(openclaw_lens_webhook_received_total[5m]))",
"legendFormat": "Received",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
]
},
{
"id": 8,
"title": "Session Completion Rate",
"description": "Session completion rate vs 1h average — tracks successful vs errored session endings. High start-with-no-completion is a stronger security signal than raw start rate.",
"type": "timeseries",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 6 },
"fieldConfig": {
"defaults": { "custom": { "drawStyle": "line", "lineWidth": 2, "fillOpacity": 10 } },
"overrides": [
{
"matcher": { "id": "byName", "options": "Anomaly threshold (2x avg)" },
"properties": [
{ "id": "color", "value": { "fixedColor": "red", "mode": "fixed" } },
{ "id": "custom.lineStyle", "value": { "fill": "dash", "dash": [10, 10] } },
{ "id": "custom.fillOpacity", "value": 0 }
]
}
]
},
"targets": [
{
"refId": "A",
"expr": "sum(rate(openclaw_lens_sessions_completed_total[5m]))",
"legendFormat": "Session completion rate",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
},
{
"refId": "B",
"expr": "2 * avg_over_time(sum(rate(openclaw_lens_sessions_completed_total[5m]))[1h:5m])",
"legendFormat": "Anomaly threshold (2x avg)",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
]
},
{
"id": 9,
"title": "Unique Sessions (1h rolling)",
"description": "Unique session IDs in a 1h sliding window — sudden spikes indicate session enumeration or token theft",
"type": "timeseries",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 14 },
"fieldConfig": {
"defaults": { "custom": { "drawStyle": "line", "lineWidth": 2, "fillOpacity": 15 } }
},
"targets": [
{
"refId": "A",
"expr": "openclaw_lens_unique_sessions_1h",
"legendFormat": "Unique sessions (1h)",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
]
},
{
"id": 10,
"title": "Cost Trajectory",
"description": "Daily accumulated cost — sudden spikes may indicate token theft leading to expensive operations",
"type": "timeseries",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 14 },
"fieldConfig": {
"defaults": {
"custom": { "drawStyle": "line", "lineWidth": 2, "fillOpacity": 15, "gradientMode": "scheme" },
"unit": "currencyUSD",
"thresholds": {
"mode": "absolute",
"steps": [
{ "color": "green", "value": null },
{ "color": "yellow", "value": 10 },
{ "color": "red", "value": 50 }
]
}
}
},
"targets": [
{
"refId": "A",
"expr": "openclaw_lens_daily_cost_usd",
"legendFormat": "Daily cost",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
]
},
{
"id": 11,
"title": "── Tool Safety & Logs ──",
"type": "row",
"collapsed": false,
"gridPos": { "h": 1, "w": 24, "x": 0, "y": 22 }
},
{
"id": 12,
"title": "Tool Error Classification",
"description": "Tool errors by type (network, filesystem, timeout, other) — filesystem errors may indicate path traversal, network errors may indicate SSRF",
"type": "timeseries",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 23 },
"fieldConfig": {
"defaults": { "custom": { "drawStyle": "bars", "fillOpacity": 80, "stacking": { "mode": "normal" } } }
},
"targets": [
{
"refId": "A",
"expr": "sum by (tool, error_class) (rate(openclaw_lens_tool_error_classes_total[5m]))",
"legendFormat": "{{tool}} ({{error_class}})",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
]
},
{
"id": 13,
"title": "Session Resets by Reason",
"description": "Session context resets — unusual volume may indicate context manipulation attempts",
"type": "timeseries",
"datasource": { "type": "prometheus", "uid": "${prometheus}" },
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 23 },
"fieldConfig": {
"defaults": { "custom": { "drawStyle": "bars", "fillOpacity": 80, "stacking": { "mode": "normal" } } }
},
"targets": [
{
"refId": "A",
"expr": "sum by (reason) (increase(openclaw_lens_session_resets_total[1h]))",
"legendFormat": "{{reason}}",
"datasource": { "type": "prometheus", "uid": "${prometheus}" }
}
]
},
{
"id": 14,
"title": "Security Events (Loki)",
"description": "Prompt injection detections, tool loops, and gateway lifecycle events from structured logs",
"type": "logs",
"datasource": { "type": "loki", "uid": "${loki}" },
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 31 },
"options": {
"showTime": true,
"showLabels": true,
"showCommonLabels": false,
"wrapLogMessage": true,
"sortOrder": "Descending",
"dedupStrategy": "none",
"enableLogDetails": true
},
"targets": [
{
"refId": "A",
"expr": "{service_name=\"openclaw\"} | event_name=~\"prompt_injection.detected|tool.loop|session.reset\"",
"datasource": { "type": "loki", "uid": "${loki}" }
}
]
},
{
"id": 15,
"title": "Gateway Lifecycle Events (Loki)",
"description": "Gateway start/stop events — frequent restarts indicate instability or unauthorized access",
"type": "logs",
"datasource": { "type": "loki", "uid": "${loki}" },
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 31 },
"options": {
"showTime": true,
"showLabels": true,
"showCommonLabels": false,
"wrapLogMessage": true,
"sortOrder": "Descending",
"dedupStrategy": "none",
"enableLogDetails": true
},
"targets": [
{
"refId": "A",
"expr": "{service_name=\"openclaw\"} | component=\"lifecycle\" | event_name=~\"gateway.*\"",
"datasource": { "type": "loki", "uid": "${loki}" }
}
]
}
]
}