Blog

DarkMoon in Grafana: a live security-posture dashboard from the Pro API

Two ways to see DarkMoon posture in Grafana: an Infinity-datasource dashboard you import in minutes, or a signed Go-backend app plugin that keeps the token server-side. Overview to campaign to finding to evidence metadata to remediation PR, with safe fields only.

· 7 min read

Grafana is where most teams already watch everything else. The DarkMoon Grafana integration puts your offensive security posture on the same wall: campaigns, findings, severity and status distributions, MITRE coverage and remediation, refreshed from the DarkMoon Pro REST API.

Pro edition

This integration reads the Pro REST API (/api/v1, JWT auth). The open-source CLI edition has no HTTP surface, so the live Grafana dashboards are a Pro capability.

Two ways to wire it

  • Import a dashboard, use the Infinity datasource. Point the community Infinity datasource at the DarkMoon API and import the provided dashboard JSON. Nothing to build, and it works on Grafana Cloud as well as self-hosted.
  • Install the app plugin. A self-hosted Grafana app with a Go backend datasource that keeps the API token in secureJsonData, server-side, never exposed to the browser. Privately signed for your organisation.

The Security Posture dashboards

The dashboards mirror the DarkMoon web app so a SOC analyst reads the same picture in Grafana that a pentester reads in the product: overview KPIs, findings over time, severity and status distributions, campaigns, targets, a full vulnerabilities table, MITRE ATT&CK, technologies, remediation pull requests, and the derived retest verdicts. A demo dashboard ships with the bundled Demo Shop dataset so you can see it populated before you connect your own instance.

Drill-down that follows the evidence

The panels are wired for the workflow, not just the summary: overview to campaign to finding to evidence metadata to remediation PR. You start at the number that worries you and end at the specific finding and the fix that addresses it.

It reads the same endpoints the web app does: /api/v1/dashboard/overview, /campaigns, /vulnerabilities, /targets, /pull-requests and the retest routes.

Safe fields only

Evidence is shown as counts and booleans, never as descriptions, raw request or response bodies, or report content. The two-key redaction rule that governs the API governs the dashboards.

Getting started

The repo ships provisioning/, a docker-compose.yml and fixtures for a reproducible local Grafana, so you can stand the whole thing up, confirm the panels, then point it at your real instance. See the integrations catalog for how Grafana fits alongside Splunk and the CI integrations.

Run it against your own lab

Darkmoon is open source (GPL-3.0) and self hosted. Clone it, point it at a target you own, and read every line.