Custom Dashboard Components

When you add or edit a custom dashboard, you can add these components:

• Saved chart—a previously saved chart

• Text box—use this to add static text

• Count—use this to add a dynamic count

• Area chart—use this to visualize change over time

• Bar chart—use this to compare several categories

• Pie chart—use this to see the distribution of items compared to the total

• Heatmap—use this to see a geographic distribution of source or destination IP addresses

• Table—use this to add a simple table of data

• Predefined chart—one of the charts built in to Stellar Cyber

Adding a Saved Chart

To add a saved chart:

1. Click Add saved chart. The selection screen appears.

   

2. Click the drop-down and select the saved chart.

The chart is added and your canvas is displayed. You can still edit, delete, and move your chart.

Adding a Text Box

To add a text box:

1. Click the New text button. A text box is immediately added and your canvas is displayed.

   
   

2. Enter and format your text.

You can still edit, delete, and move your text box.

Adding a Count

To add a count:

1. Click Counter. The Chart Builder dialog box appears.

   

2. Enter the Chart Name. Ours is Data Ingestion Anomalies. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

3. Choose the Tenant. We chose All Tenants.

4. Choose the Indices. We chose Alerts.

5. Choose a saved Query or create a new query. The query is optional.

   To remove a selected query, set the query value to None. Deleting it completely removes it.

6. Click Next. The Groupings tab is displayed.

   

7. Choose the Metric. We chose Max and selected a metric in the displayed field.

8. Click Next. The Options tab is displayed.

   

9. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

   • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

   • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

10. Click Submit.

The count is added and your canvas is displayed. You can still edit, delete, and move your chart.

Adding an Area Chart

To add an area chart:

1. Click New area chart. The Chart Builder dialog box appears.

   

2. Enter the Chart Name. Ours is AWS CloudTrail Events. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

3. Choose the Tenant. We chose All Tenants.

4. Choose the Indices. We chose the Alerts and AWS Events indices.

5. Choose a saved Query or create a new query. The query is optional.

   To remove a selected query, set the query value to None. Deleting it completely removes it.

6. Click Next. The Groupings tab appears.

   

7. Choose the Field to group by. We set detect_time.

8. Choose the Interval Time.

9. Choose the Interval Unit.

10. Choose the Metric. We left it as Count.

    If you choose anything but Count, enter the Metric Field.

11. Click Next. The Options tab appears.

    

12. Enter a Y-Axis Label.

13. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

14. Click Submit.

The chart is added and your canvas is displayed. You can still edit, delete, and move your chart.

Adding a Bar Chart

To add a bar chart:

1. Click New bar chart. The Chart Builder dialog box appears.

   
   

2. Enter the Chart Name. Ours is Multiple User Login Fails. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

3. Choose the Tenant. We chose All Tenants.

4. Choose the Indices. We chose Windows Events.

5. Choose a saved Query or create a new query. The query is optional.

   To remove a selected query, set the query value to None. Deleting it completely removes it.

6. Click Next. The Groupings tab appears.

   

7. Choose the Aggregation. Choose Term to group data by the text in the fields (useful when your data is text, such as tenant names), choose Range to group data by ranges (useful when your data is numeric, such as severity), or choose Filter to define filters for the data groups.

   Define your aggregation. The options differ based on your choice.

8. Click Next. The Options tab appears.

   

9. Choose Horizontal to display the bars horizontally.

10. Enter optional labels for the axes.

11. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

12. Click Submit.

The chart is added and your canvas is displayed. You can still edit, delete, and move your chart.

Adding a Pie Chart

To add a pie chart:

1. Click New pie chart. The Chart Builder dialog box appears.

   
   

2. Enter the Chart Name. Ours is Source IP Addresses. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

3. Choose the Tenant. We chose All Tenants.

4. Choose the Indices. We chose Traffic.

5. Choose a saved Query or create a new query. The query is optional.

   To remove a selected query, set the query value to None. Deleting it completely removes it.

6. Click Next. The Groupings tab appears.

   

7. Choose the Aggregation. Choose Term to group data by the text in the fields (useful when your data is text, such as tenant names), choose Range to group data by ranges (useful when your data is numeric, such as severity), or choose Filter to define filters for the data groups. The options differ based on your choice. In this example, we illustrate the fields that display when you add a basic filter. Define your aggregation.

8. Click Next. The Options tab is displayed.

   

9. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

   • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

   • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

10. Click Submit.

The chart is added and your canvas is displayed. You can still edit, delete, and move your chart.

To switch between a pie chart and a donut chart, simply click the or icon in the upper right corner of the component after you save the dashboard.

Adding a Heatmap

To add a heatmap:

1. Click New heatmap.

   The Chart Builder dialog box appears with Heatmap selected.

   

2. Click Next.

3. Enter the Chart Name. Ours is Alerts by Geo. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

4. Choose the Tenant. We chose All Tenants.

5. Choose the Indices. We chose Alerts.

6. Choose a saved Query or create a new query. The query is optional.

   To remove a selected query, set the query value to None. Deleting it completely removes it.

   Here's how the Chart Builder looks with our settings so far:

   

7. Click Next. The Groupings tab appears.

8. Choose one of the following Field types:

   • dst_ip_geopoint – Show heatmap based on destination IP addresses matching the query in the previous steps.

   • src_ip_geopoint – Show heatmap based on source IP addresses matching the query in the previous steps.

9. Choose the type of Metric to use for the Field. You can choose from Average, Count, Max, Min, or Sum. We have chosen Count so that the heatmap will display clusters based on alert counts.

   

10. Click Next. The Options tab appears.

    

11. Name and set your thresholds. The thresholds specify at what value the heatmap will change the color codes of geopoints shown in the display. This way, geopoints with a higher count are displayed, for example, in red.

12. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

13. Click Submit.

The heat map is added and your canvas is displayed. You can still edit, delete, and move your chart. Be sure to save your changes when you are done.

Heatmap Example

The figure below illustrates a sample heatmap based on the settings we used in the previous procedure.

Note the following:

• We configured the chart to display a heatmap based on the source IP addresses of detected alerts. The color-coded geopoints illustrate at a glance where the greatest number of alerts are concentrated based on the legend at the right of the heatmap.

• Alerts are clustered into geopoints using an ElasticSearch GeoHash precision of 5, resulting in boxes of 4.9km x 4.9 km. For this example, this means that a geopoint shown in the heatmap represents all alerts within that 4.9km x 4.9km box.

• Hover your mouse over any geopoint displayed in the heatmap to see its location, coordinates, and metric count. The example below shows a cluster of 109 alerts in the New York area.

  

• You can zoom the heatmap using slider at the left of the heatmap.

Converting Heatmap Charts from Previous Releases

The heatmap widget introduced in the 4.2.0 release is a complete replacement of the one used in previous releases and includes new geolocation capabilities. Note that any existing dashboards using a heatmap chart continue to use the old heatmap widget until you edit the charts manually using the following procedure:

1. First, identify the Dashboards using heatmap charts:

   1. Navigate to Visualize | Creation | Charts.

   2. Type heatmap into the Search box and press Enter.

      The table updates to show only charts with a Chart Type of heatmap.

   3. Sort the table in descending order by the In Use column. This way, the heatmap charts that are actually in use in a dashboard are listed at the top of the table.

   4. Hover your mouse over the In Use column to see the name of the Dashboard(s) where each heatmap chart is used. Take note of these names.

2. Next, you need to edit the dashboards and replace the legacy heatmaps with new ones.

   1. Navigate to  Visualize | Custom (Dashboards).

   2. Click the entry for the first dashboard with a heatmap chart you identified in the previous step.

   3. Click the Edit button for the dashboard.

   4. Take note of the settings for the existing heatmap, in particular the Indices and Queries.

   5. Delete the existing heatmap by clicking the x in its upper right corner.

   6. Add a new heatmap using the same Indices and Queries.

   7. Click Save.

   8. Repeat this procedure for any other dashboards using legacy heatmaps.

Adding a Table

To add a table:

1. Click New table. The Chart Builder dialog box appears.

   

2. Enter the Chart Name. Ours is All Login Failures. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

3. Choose the Tenant. We chose All Tenants.

4. Choose the Indices. We chose Windows Events.

5. Choose a saved Query or create a new query. The query is optional.

   To remove a selected query, set the query value to None. Deleting it completely removes it.

6. Choose the Table Type. We left it as Per record.

7. Click Next. The Groupings tab appears if you chose the Groupings type. We chose Per record, so the Options tab appears.

   

8. Click the + Column button to add columns.

9. Choose the data for each column.

10. Enter a title for each column.

11. Enter the column to Sort By if you want.

12. Choose the Rows per Page.

13. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

14. Click Submit.

The table is added and your canvas is displayed. You can still edit, delete, and move your table. Here are examples of tables to look at events by:

• Top 5 pairs of source and destination IP addresses

• Top 5 sensors with the most events

• Source IP addresses by fidelity

• Top 5 source IP addresses per day

• Top 5 source IP addresses average fidelity and severity

Adding a Predefined Chart

To use one of the many predefined charts built into Stellar Cyber:

1. Click the Saved Chart icon above the dashboard canvas. This places a chart selector in your dashboard canvas.

2. Click the next to the Chart Selection field on the new chart component you created. The Predefined Charts dialog appears.

   
   

3. Choose a Chart Category to narrow your search. This is not necessary, but we recommend it, as there are many charts, and more are added at each release. In the example above, we enter a field to search for charts that use ade_outbytes_anomaly.

4. Choose a Chart Type to further narrow your search. We left the default selection of any.

5. Choose a Chart.

6. Click Submit.

The chart is immediately updated, and the name changed to match the chart you selected. You can no longer edit this chart, but you can select a different predefined chart.