Adding a Table to Display Sensors with the Most Events

To add a table that displays the top 5 sensor with the most events to your custom dashboard:

1. Click the Visualize menu and locate the Custom menu block.

2. Click the dashboard you want to edit. The dashboard appears.

3. Click Edit. The display switches to the editing canvas.

4. Click New table. The Chart Builder dialog box appears.

5. Enter the Chart Name. Ours is Top 5 Sensor IDs. This field does not support multibyte characters.

   Special characters are not permitted in name fields for Queries, Lookup lists, or Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

6. Choose the Tenant. We chose All Tenants.

7. Choose the Indices. We chose Security Events.

8. Leave the query as None. The query is optional.

9. Choose Groupings for the Table Type.

10. Click Next. The Groupings tab appears.

11. Click + Add Grouping twice to add a total of three groupings. The groupings are processed sequentially, and you can move them to change the configuration.

12. Open the Column 1 grouping.

13. Enter a better Column Label. We chose IP Address.

14. Choose Filter for the Aggregation.

15. Click + Query String Filter.

16. Name the filter scrip exists.

17. Enter _exists_:srcip for the Query String.

18. Click + Filter.

19. Name the filter dstip exists.

20. Choose dstip for the Field.

21. Choose field exists for the Operator.

22. Open the Column 2 grouping.

23. Enter a Column Label. We chose Sensor engid.

24. For the remaining fields:

    • Aggregation: Term

    • Field: engid

    • Metric: Count

    • Order: Descending

    • Size: 5

25. Open the Column 3 grouping.

26. Enter a Column Label. We chose Number of IPs.

27. For the remaining fields:

    • Aggregation: Metric

    • Metric: Count

28. Click Next. The Options tab appears.

29. Click Submit. The table is added and the editing canvas appears.

30. Click Save. The dashboard appears with your new table.