Displaying Dashboards

Changing the View Of Dashboard Item Data

You can change widget views or add widgets with different views in your dashboards so that you can see data from other perspectives.

In this scenario, you want to add a pie chart view of the Events per user chart to the Miscellaneous metrics dashboard. By default, the dashboard displays the bar chart view.

1. To change the view of a dashboard chart, click More options > Settings to flip the card, and select the view to display.

2. To add another view of the dashboard chart, complete the following steps:

   1. From the Miscellaneous metrics dashboard, click Configure Dashboard , and scroll down the list to find the item names of the chart view you want to add to the dashboard.

      

   2. Click Add for each view you want to add to the dashboard, and click Done.

Both chart views are available on the dashboard.

Visualizing Security Incidents on the Threat Globe Dashboard

The 3D threat globe dashboard displays where incidents are occurring. Threat researchers can use the visualization to see whether the same attacks are happening everywhere across the globe or just at specific customer sites.

The threat globe gathers initial data to populate the 3D globe, so it might take a few minutes to complete the visualization.

1. Select the event categories that you want to see on the globe. Click Filter Categories to display the list of offense categories. By default, all categories are selected.

   1. To add or remove a category from the top list, select it.

   2. To set the new categories, click Done.

2. Rotate the globe to focus on a country or continent. Events are plotted on the 3D globe according to their location in a country. Turn off the auto-rotate function and then zoom in to focus on a country. Click and drag the globe to change the angle. Use the following legend to understand what you see on the globe:

   

   • Magnitude: Specifies how bad the offense is. The height of the visual spike on the globe indicates the severity of the offense.

     The magnitude rating of an offense is calculated based on relevance, severity, and credibility.

     • Relevance determines the impact of the offense on your network. For example, if a port is open, the relevance is high.

     • Credibility indicates the integrity of the offense as determined by the credibility rating that is configured in the log source. Credibility increases as multiple sources report the same event.

     • Severity indicates the level of threat that a source poses in relation to how prepared the destination is for the attack.

   • Frequency: The size of the circles on the globe indicates the frequency of new events that are coming in to the threat globe.

   • Frequency trending: If the concentric circles continue to expand outwards, the frequency of offenses is increasing.

   • Source to destination: The path arcs from the source IP to the destination IP.

3. Hover over a security event category. Unrelated low-level categories are filtered from the top five low-level categories and the event rate chart.

   

4. Hover over the top five low-level categories to see which high-level security event category they belong to.

   

5. The Offenses section initially displays the top 10 offenses with recent activity that are currently open, sorted by severity, credibility, and relevance. As the app runs, the list is supplemented with new offenses from recent events. Click an offense to investigate it further.

   

6. The timeline graph at the bottom of the page shows the last 15 minutes (default) of real-time activity. Pause the timeline and then rewind it to replay the events as they came into the threat globe. Hover over the timeline to see the date and time. The event rate is a running list of the events as they come in. When you pause the timeline, the event rate also pauses.

   Note:

   • You can customize the length of time of the real-time activity on the Configuration page.

   • By default, there is a 10-minute (600 seconds) delay from when QRadar collects an offense to when it is displayed in the threat globe.

   • The threat globe's filtering is not based on whether an offense is active or inactive. Instead, it shows open offenses with events that fall within an approximate 15-minute time frame after a real-time delay of around 10 minutes.

7. The Event rate chart displays the rate at which security events are collected by QRadar before they're visualized in the threat globe. In the screen capture, the number on the right reflects the total events that came in during 1 minute. The number on the left reflects the number for the event categories that are selected in the Security events section. Hover over the lines to display the high-level category. Events that are filtered from the Security Event categories appear as gray lines.

   

Event Categories That Are Visualized in the Threat Globe Dashboard

Event categories are used to group incoming events for visualizing by the Threat Globe. Events that occur on your network are aggregated into high-level and low-level categories. Each high-level category contains low-level categories and an associated severity level and ID number.

Investigating the Details Of an Offense from the Threat Globe Dashboard

Conduct a more comprehensive investigation by studying the details of a particular offense.

1. From the main global view, click an offense to open the Offense Details page. The visualization display expands to show you the selected offense and where it is occurring on the 3D globe.

   

2. Click View full details to get detailed information in a separate browser tab.

3. Click the Pulse tab (or click the left arrow) to return to the original screen with refreshed content.

Visualizing the Average Magnitude of an Event on a Geographic Chart

In this example, you set the source and destination IP addresses, edit the colors that display on the scatter geo chart, and set the chart to auto rotate in the dashboard.

To ensure that the map renders properly in QRadar Pulse, your browser must be connected to the Internet.

1. Click Configure dashboard.

   The Configure dashboard screen displays a library of available widgets, with details about each widget.

2. Click Create new widget.

3. On the New Dashboard Item page, enter Magnitude of events as the name and provide a description.

4. Select AQL as the data source, set the Refresh Time to every 5 minutes, and enter the following AQL query in the AQL Statement field:

5. Set the Results Limit to 1000, and click Run Query.

6. Configure the chart display. In the Views section of the page, enter Magnitude of events as the View Name and select Geographic Chart as the chart type.

7. On the General tab, select sourceGeo in the Geographic Data field, and click the More options icon.

   1. Leave the Axis Label as sourceGeo.

   2. Select sourceGeo as the Hover Text.

   3. Pick a round symbol, green color, and size 5 for the data point.

   4. Click the More options icon to minimize the selected row.

      

8. Click Add Series, select destinationGeo, and repeat step 7. In step 7 (c), change the values to a diamond symbol, pink color, and size 8 for the data point.

   

9. Select Globe (Orthographic) for the Projection.

10. Set Show Legend to Yes, and pick the Vertical legend orientation.

11. On the Thresholds tab, click Add Threshold Indicator. You can apply thresholds only if the AQL query contains numeric columns, such as Average Magnitude, Number of Events and count(*).

    1. Select a threshold indicator, and click the More options icon.

    2. Select a column, add a threshold value, and then click Add Threshold.

    3. Change the option or use the default options. Add as many threshold values as you need.

    4. Optional: For the Point Color threshold, select a color scale mode to display on the dashboard item.

12. Optional: Pick a scale mode to display for the Point Color threshold. The color scale mode displays under the legend on the dashboard item.

13. On the Map tab, enable all of the options except for Display Grid.

14. Pick colors for the lines, land, water, borders of the map. Choose whether to display the map grid or not.

15. On the Viewport tab, configure the latitude, longitude, and scale for how the map displays in the dashboard item. When you're happy with the preview display, click Set latitude, longitude, and scale as seen in the preview.

16. Click Save.

    

17. Optional: Click the Settings icon on the dashboard item, and toggle the Autorotate Globe switch.