No security dashboard — the Suricata and filterlog labels are parsed, alerted on, and never charted #82

config.alloy goes to real trouble to extract low-cardinality labels from
security-relevant logs — deliberately, per ADR-0003, keeping addresses and ports
in the line and only the useful dimensions as labels:

• filterlog (pfSense): interface, action, direction
• Suricata: classification, priority

Five Loki rules fire on them — TerminalSegmentReachedInternalNetwork,
IoTAttemptedLateralMovement, FirewallLogsStopped, SuricataHighPriorityAlert,
SuricataAlertStorm.

None of it is charted anywhere. "Network & Firewall" is SNMP only — pf state
table, interface counters, iLO health. "Logs" is generic: volume by level, by
source, by host, plus three raw streams. The labels that were the whole point of
the parsing work have no view.

What it should carry

• Blocks per second by interface and direction, which is the shape of a scan
  or a misconfigured device.
• Top blocked source addresses over the window — extracted at query time from
  the line, not from a label, so the cardinality stays where ADR-0003 put it.
• Suricata alerts by classification and by priority, with the priority-1
  stream underneath.
• Terminal-segment violations: anything from VLAN 10/20/40 aimed at an internal
  network. That is the rule the segmentation design exists to enforce, and there
  is currently no way to look at it except as an alert that has already fired.
• Firewall log arrival rate, so FirewallLogsStopped has something to sit next
  to.

Suricata has been running on Skids (VLAN 20) alert-only since 2026-08-21, so
there is real data to build against — and the roadmap item to extend it to VLAN
10 will be much easier to judge with a picture of what Skids produces.

Found while verifying #12.