Adding a Table to Display IP Address Pairs with the Most Events

To add a table that finds the source and destination IP address pairs with the most events to your custom dashboard:

  1. Click the Visualize menu and locate the Custom menu block.

  2. Click the dashboard you want to edit. The dashboard appears.

  3. Click Edit. The display switches to the editing canvas.

  4. Click New table. The Chart Builder dialog box appears.

  5. Enter the Chart Name. Ours is Top 5 Source/Destination IP Pairs. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  6. Choose the Tenant. We chose All Tenants.

  7. Choose the Indices. We chose Security Events.

  8. Leave the query as None. The query is optional.

  9. Choose Groupings for the Table Type.

  10. Click Next. The Groupings tab appears.

  11. Click + Add Grouping twice to add a total of three groupings. The groupings are processed sequentially, and you can move them to change the configuration.

  12. Open the Column 1 grouping.

  13. Enter a better Column Label. We chose Source IP Address.

  14. For the remaining fields:

    • Aggregation: Term

    • Field: srcip

    • Metric: Count

    • Order: Descending

    • Size: 5

  15. Open the Column 2 grouping.

  16. Enter a Column Label. We chose Destination IP Address.

  17. For the remaining fields:

    • Aggregation: Term

    • Field: dstip

    • Metric: Count

    • Order: Descending

    • Size: 5

  18. Open the Column 3 grouping.

  19. Enter a Column Label. We chose Total.

  20. For the remaining fields:

    • Aggregation: Metric

    • Metric: Count

  21. Click Next. The Options tab appears.

  22. Click Submit. The table is added and the editing canvas appears.

  23. Click Save. The dashboard appears with your new table.