Using Chart Builder

This topic describes how to access a table of all previously created charts and tables used in Dashboards or Reports. It also describes how to edit or delete existing charts using the Chart Builder, as well as how to create new charts for later use.

Access the Chart Builder as follows:

 Visibility of items in this table are restricted based on Tenant.

The scope of a query determines which tenants can use it. Whether it's possible to create a query for All Tenants depends on the scope of the object being queried, such as charts, correlations, and Automated Threat-Hunting (ATH) rules. In short, the scope of a queried object cannot be more restrictive than the scope of the query itself. For example, if you create an ATH rule for All Tenants, then the query for this ATH rule can either be All Tenants or just a single tenant, such as "Tenant A" for example. However, if you create an ATH rule for Tenant A, then the query cannot be for All Tenants because the other tenants won’t have this ATH rule and won’t be able to query it. In this case, the query can only be for Tenant A.

Working with the Charts List

When you launch charts from the Visualize | Creation | Charts menu, a list of existing charts is displayed. From here, you can manage charts, and create new ones, either from scratch or by cloning an existing chart. These are displayed in a table that can be sorted, searched and exported in the same way as other tables in Stellar Cyber.

Use the charts list to manage the charts available for display in dashboards throughout the Stellar Cyber product. Note the following:

  • Dashboards created by System are default and cannot be modified or deleted.  Instead, clone the chart and modify the copy.

  • Custom charts created prior to upgrade of a system to Stellar Cyber v4.2.0, which introduced several new fields in this list, have blank values in those fields (such as Creator or Date Created ).  This is expected.

  • The In Use field, introduced in Stellar Cyber v4.2.0, allows you to see which dashboards are affected by changes you make to the chart.

  • Before you are permitted to delete a chart, you must remove it from any associated dashboards. Hover your mouse over the In Use field to identify dashboards using that chart. Navigate to Visualize | Creation | Dashboards to access and modify the dashboards.

  • When cloning a chart, make sure that the source chart does not include any special characters in its name. Chart Builder prevents you from creating new charts with disallowed special characters but does not prevent cloning of existing charts with disallowed special characters. Letters, underscores, spaces, dashes, numbers and periods are permitted.

The charts list, like many tables in Stellar Cyber, supports export, sorting, edit, and delete operations. You can use the a couple of options to filter charts based on any of the chart attributes. Expand a row and select the attribute, or click the ellipsis   button on a field and then select the filter option

Creating and Editing Charts

When you click create or edit from the Chart Builder table, or from a Dashboard, the chart builder tool opens.

Launched From Menu Launched from a Dashboard

From either launch point you can use the following features to create or modify a chart:

  • Counter—use this to add a dynamic count

  • Area chart—use this to visualize change over time

  • Bar chart—use this to compare several categories

  • Pie chart—use this to see the distribution of items compared to the total

  • Heatmap—use this to see a geographic distribution

  • Table—use this to add a simple table of data

About the "Filter by event status" Option

Regardless of the type of chart you are creating, the Chart Builder's last step lets you configure the Filter by event status option. This feature specifies whether data in this chart is subject to the global Status filter available in the main toolbar:

  • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

  • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

The figure below summarizes how this option works:

Adding a Count

To add a count:

  1. Click Counter. The Chart Builder dialog box appears.

  2. Enter the Chart Name. Ours is Data Ingestion Anomalies. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  3. Choose the Tenant. We chose All Tenants.

  4. Choose the Indices. We chose Alerts.

  5. Choose a saved Query or create a new query. The query is optional.

    To remove a selected query, set the query value to None. Deleting it completely removes it.

  6. Click Next. The Groupings tab is displayed.

  7. Choose the Metric. We chose Max and selected a metric in the displayed field.

  8. Click Next. The Options tab is displayed.

  9. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

  10. Click Submit.

Adding an Area Chart

To add an area chart:

  1. Click New area chart. The Chart Builder dialog box appears.

  2. Enter the Chart Name. Ours is AWS CloudTrail Events. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  3. Choose the Tenant. We chose All Tenants.

  4. Choose the Indices. We chose the Alerts and AWS Events indices.

  5. Choose a saved Query or create a new query. The query is optional.

    To remove a selected query, set the query value to None. Deleting it completely removes it.

  6. Click Next. The Groupings tab appears.

  7. Choose the Field to group by. We set detect_time.

  8. Choose the Interval Time.

  9. Choose the Interval Unit.

  10. Choose the Metric. We left it as Count.

    If you choose anything but Count, enter the Metric Field.

  11. Click Next. The Options tab appears.

  12. Enter a Y-Axis Label.

  13. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

  14. Click Submit.

Adding a Bar Chart

To add a bar chart:

  1. Click New bar chart. The Chart Builder dialog box appears.


  2. Enter the Chart Name. Ours is Multiple User Login Fails. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  3. Choose the Tenant. We chose All Tenants.

  4. Choose the Indices. We chose Windows Events.

  5. Choose a saved Query or create a new query. The query is optional.

    To remove a selected query, set the query value to None. Deleting it completely removes it.

  6. Click Next. The Groupings tab appears.

  7. Choose the Aggregation. Choose Term to group data by the text in the fields (useful when your data is text, such as tenant names), choose Range to group data by ranges (useful when your data is numeric, such as severity), or choose Filter to define filters for the data groups.

    Define your aggregation. The options differ based on your choice.

  8. Click Next. The Options tab appears.

  9. Choose Horizontal to display the bars horizontally.

  10. Enter optional labels for the axes.

  11. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

  12. Click Submit.

Adding a Pie Chart

To add a pie chart:

  1. Click New pie chart. The Chart Builder dialog box appears.


  2. Enter the Chart Name. Ours is Source IP Addresses. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  3. Choose the Tenant. We chose All Tenants.

  4. Choose the Indices. We chose Traffic.

  5. Choose a saved Query or create a new query. The query is optional.

    To remove a selected query, set the query value to None. Deleting it completely removes it.

  6. Click Next. The Groupings tab appears.

  7. Choose the Aggregation. Choose Term to group data by the text in the fields (useful when your data is text, such as tenant names), choose Range to group data by ranges (useful when your data is numeric, such as severity), or choose Filter to define filters for the data groups. The options differ based on your choice. In this example, we illustrate the fields that display when you add a basic filter. Define your aggregation.

  8. Click Next. The Options tab is displayed.

  9. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

  10. Click Submit.

Adding a Heatmap

To add a heatmap:

  1. Click New heatmap.

    The Chart Builder dialog box appears with Heatmap selected.

  2. Click Next.

  3. Enter the Chart Name. Ours is Alerts by Geo. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  4. Choose the Tenant. We chose All Tenants.

  5. Choose the Indices. We chose Alerts.

  6. Choose a saved Query or create a new query. The query is optional.

    To remove a selected query, set the query value to None. Deleting it completely removes it.

    Here's how the Chart Builder looks with our settings so far:

  7. Click Next. The Groupings tab appears.

  8. Choose one of the following Field types:

    • dst_ip_geopoint – Show heatmap based on destination IP addresses matching the query in the previous steps.

    • src_ip_geopoint – Show heatmap based on source IP addresses matching the query in the previous steps.

  9. Choose the type of Metric to use for the Field. You can choose from Average, Count, Max, Min, or Sum. We have chosen Count so that the heatmap will display clusters based on alert counts.

  10. Click Next. The Options tab appears.

  11. Name and set your thresholds. The thresholds specify at what value the heatmap will change the color codes of geopoints shown in the display. This way, geopoints with a higher count are displayed, for example, in red.

  12. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

  13. Click Submit.

For more on heatmaps and converting them from previous releases, refer to the related Dashboard component topic.

Adding a Table

To add a table:

  1. Click New table. The Chart Builder dialog box appears.

  2. Enter the Chart Name. Ours is All Login Failures. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  3. Choose the Tenant. We chose All Tenants.

  4. Choose the Indices. We chose Windows Events.

  5. Choose a saved Query or create a new query. The query is optional.

    To remove a selected query, set the query value to None. Deleting it completely removes it.

  6. Choose the Table Type. We left it as Per record.

  7. Click Next. The Groupings tab appears if you chose the Groupings type. We chose Per record, so the Options tab appears.

  8. Click the + Column button to add columns.

  9. Choose the data for each column.

  10. Enter a title for each column.

  11. Enter the column to Sort By if you want.

  12. Choose the Rows per Page.

  13. Use the Filter by status option to specify whether data in this chart is subject to the global Status filter available in the main toolbar:

    • Enabled (default) – Chart data can be filtered using the global Status filter in the main toolbar.

    • Disabled – Chart data is displayed regardless of the current setting of the global Stats filter in the main toolbar.

  14. Click Submit.