Dashboard Tools¶

Adding a Widget¶

Widgets help you monitor logs in real-time. A widget is based on data retrieved from a search query. You set up a widget and add it to a dashboard. For example, to monitor the firewall activities of devices, create a widget with the search queries related to the firewall.

1. Go to Dashboard from the navigation bar.

2. Click on All Dashboards. Select a Dashboard and click Add Widget.

3. Enter a Name for the widget.

Creating a Widget¶

4. Enter a Query. Alternatively, click Select to select a query from Advanced Query Picker.

Advanced Query Picker¶

5. Select the Repos to access the logs that are stored in it.

6. Select a Limit number of logs to generate.

7. Select Expose widget to public URL? to share the widget with other users. If you select Expose widget to public URL?, you can click Open public URL to open the search results in a new window.

   

   Open Public URL¶

8. Enter a Description for the widget.

9. Select a Time Range for the logs in the repos. You can set a time range in minutes, hours, or days. The maximum limit of the time range for the day field is 30.

10. Click Finish.

If Data Privacy Module is enabled, Can Request Access users can only view encrypted data.

Editing a Widget¶

You can edit a widget by clicking the Widget Options icon at the top-right.

Widget Options Icon¶

Edit a widget options include:

Widget Options¶

You can Search for the results, get Info, Edit, Remove, and open the widget in Public URL. You can also toggle the display of the Legend if there is one.

Additionally, you can create Alerts and Incidents. Go to Alerts and Incidents in Search and Analytics for details.

You can also create and use graphs, including tables, area charts, line charts, bar charts, column charts, gauge charts, display charts, and donut charts. The type of graph you can use depends on the type of search results.

Tables¶

The following query:

| chart count() by action

Generates the following table:

Count of logs grouped by device_ip¶

The other graphs are:

• Area Chart

• ATT&CK chart

• Bar Chart

• Bubble Chart

• Clustered Bar Chart

• Clustered Column Chart

• Clustered Line Chart

• Column Chart

• Day/Hour Heatmap Chart

• Display Chart

• Donut Chart

• Gauge Chart

• Heatmap Chart

• Line Chart

• Parallel Coordinate Chart

• Radar chart

• Sankey chart

• Stacked Area Chart

• Stacked Column Chart

• TreeMap Chart

• World Map Chart

Report¶

You can use dashboards to generate reports. A report replicates the contents and data in a widget. You can’t schedule or change a report’s layout in a widget.

To create a report using a Dashboard, go to Creating Reports in Reports.

Change Repos¶

You can change the Repos for log results of all the Widgets in the Dashboard.

Auto Arrange¶

You can manually change the sizes and position of widgets, you can also use Auto Arrange.