Adding a Table to Display Source IP Addresses by Average Fidelity & Severity

To add a table that displays source IP addresses by average fidelity and severity to your custom dashboard:

  1. Click the Visualize menu and locate the Custom menu block.

  2. Click the dashboard you want to edit. The dashboard appears.

  3. Click Edit. The display switches to the editing canvas.

  4. Click New table. The Chart Builder dialog box appears.

  5. Enter the Chart Name. Ours is Top 5 Source IP Addresses Fidelity & Severity. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  6. Choose the Tenant. We chose All Tenants.

  7. Choose the Indices. We chose Security Events.

  8. Leave the query as None. The query is optional.

  9. Choose Groupings for the Table Type.

  10. Click Next. The Groupings tab appears.

  11. Click + Add Grouping thrice to add a total of 4 groupings. The groupings are processed sequentially, and you can move them to change the configuration.

  12. Open the Column 1 grouping.

  13. Enter a better Column Label. We chose Source IP Address.

  14. For the remaining fields:

    • Aggregation: Term

    • Field: srcip

    • Metric: Count

    • Order: Descending

    • Size: 5

  15. Open the Column 2 grouping.

  16. Enter a Column Label. We chose Destination IP Address.

  17. For the remaining fields:

    • Aggregation: Term

    • Field: dstip

    • Metric: Count

    • Order: Descending

    • Size: 5

  18. Open the Column 3 grouping.

  19. Enter a Column Label. We chose Fidelity.

  20. For the remaining fields:

    • Aggregation: Metric

    • Metric: Average

    • Field: fidelity

  21. Open the Column 4 grouping.

  22. Enter a Column Label. We chose Severity.

  23. For the remaining fields:

    • Aggregation: Metric

    • Metric: Average

    • Field: severity

  24. Click Next. The Options tab appears.

  25. Click Submit. The table is added and the editing canvas appears.

  26. Click Save. The dashboard appears with your new table.