Adding a Table to Display Source IP Addresses by Events/Day

To add a table that groups the source IP addresses by events/day to your custom dashboard:

  1. Click the Visualize menu and locate the Custom menu block.

  2. Click the dashboard you want to edit. The dashboard appears.

  3. Click Edit. The display switches to the editing canvas.

  4. Click New table. The Chart Builder dialog box appears.

  5. Enter the Chart Name. Ours is Top 5 Source IPs per Day. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  6. Choose the Tenant. We chose All Tenants.

  7. Choose the Indices. We chose Security Events.

  8. Leave the query as None. The query is optional.

  9. Choose Groupings for the Table Type.

  10. Click Next. The Groupings tab appears.

  11. Click + Add Grouping twice to add a total of three groupings. The groupings are processed sequentially, and you can move them to change the configuration.

  12. Open the Column 1 grouping.

  13. Enter a better Column Label. We chose Date.

  14. For the remaining fields:

    • Aggregation: Date Histogram

    • Field: timestamp

    • Interval Time: 1

    • Interval Unit: Day

  15. Open the Column 2 grouping.

  16. Enter a Column Label. We chose Source IP Address.

  17. For the remaining fields:

    • Aggregation: Term

    • Field: srcip

    • Metric: Count

    • Order: Descending

    • Size: 5

  18. Open the Column 3 grouping.

  19. Enter a Column Label. We chose Number.

  20. For the remaining fields:

    • Aggregation: Metric

    • Metric: Count

  21. Click Next. The Options tab appears.

  22. Click Submit. The table is added and the editing canvas appears.

  23. Click Save. The dashboard appears with your new table.