- Dashboards
- Navigation Overview
- View and Interact with Dashboards
- View and Interact with Visualizations
- User Management
- Configure and Manage Dashboards
- Create a Dashboard
- Add a Visualization to a Dashboard
- Add a Text Tile
- Modify a Dashboard Layout
- Add Dashboard Filters
- Manage Automatic Refresh Rates
- Create a Scheduled Delivery
- Make a Dashboard Public
- Export and Import Dashboards
- Edit Dashboard Filters
- Edit Dashboard Details
- Duplicate a Dashboard
- Delete a Dashboard
- Configure and Manage Visualizations
- Create a Visualization
- Auto-Create a Visualization from a Natural Language Prompt
- Add Visualizations from the Library to a Dashboard
- Create a Visualization from a Search Query
- Modify a Visualization
- Configure Visualization Query Filters
- Include Context Filtering in Visualizations
- Make a Visualization Public
- Export and Import Visualizations
- Duplicate a Visualization
- Remove a Visualization from a Dashboard
- Delete Visualizations from the Library
- Pre-Built Dashboards
- Advanced Analytics
- Threat Center
- Case Manager
- Compliance / Event Store
- Access Grant and Revoke Activity Dashboard
- Account Logout Summary Dashboard
- Account Management Activity Dashboard
- Application Security Event Summary Dashboard
- Authenticated User Accounts on Hosts Dashboard
- AWS CloudTrail Summary Dashboard
- Data Loss Prevention Activity Dashboard – Host-Based
- Data Loss Prevention Activity Dashboard – User-Based
- Data Loss Prevention Activity Summary Dashboard
- Default Account Access Dashboard
- Default Credential Usage and Change Activity Dashboard
- Denied Web Access Activity Dashboard
- Disabled User Account Summary Dashboard
- Discovered Attacks by Source and Destination Dashboard
- Endpoint Detection and Response Dashboard
- Failed Application Logon Activity Dashboard
- Failed Audit Logs Summary Dashboard
- Failed Host Login Attempt Counts by Users Dashboard
- Failed VPN Login Attempts and Remote Session Timeouts Dashboard
- Firewall Activity Dashboard
- Firewall and Router Device Interfaces Dashboard
- Indicator of Compromise (IOC) Statistics Dashboard
- Insecure Authentication Attempts Dashboard
- Microsoft 365 Summary Dashboard
- Microsoft Windows Overview Dashboard
- Network Applications by Traffic Volume Dashboard
- Policy Activity Summary Dashboard
- Port Usage Trends Dashboard
- Privileged Access Dashboard
- Privileged Access Dashboard – User-Based
- Protocols by Network Traffic Dashboard
- Remote Session Overview Dashboard
- Security Alert Summary Dashboard – Impacted Hosts
- Security Alert Summary Dashboard – Origin Hosts
- Security Alert Summary Dashboard – Users
- Successful Application Logon Activity Dashboard
- Successful Database Login Activity Dashboard
- Successful Physical Access Dashboard
- Top Attackers Dashboard
- User Account Creation Summary Dashboard
- User Account Lockout Activity Dashboard
- Vendor Authentication Activity Dashboard
- Windows Audit Failure Summary by Hosts Dashboard
- Windows Audit Failure Summary by Users Dashboard
- Windows User Privilege Elevation Dashboard
- Zscaler HTTP Dashboard
- Correlation Rules
- SOC Management
- Pre-Built Visualizations
- Anomalies - Use Case & MITRE Coverage
- Anomalies by Rule Name
- Anomalies by Use Case
- Anomalies Count Over Time
- Anomaly Distribution by MITRE Tactic & Score
- Application Count
- Closed Incidents
- Correlation Rules by Severity
- Correlation Rules Triggered Over Time
- Detected Anomalies
- Host-Based DLP Alerts Count
- Incidents Created
- Incident Summary by Incident Type
- Number of Hosts with DLP Alerts
- SOC Incident Distribution
- Top 5 Host-Based DLP Alert Categories
- Top 5 Protocols in Host-Based DLP Alerts
- Top 10 Host-Based DLP Alert Types
- Top 10 Hosts with DLP Alerts
- Top Activities per Top 10 Applications
- Top Users per Top 10 Applications
- Trend of Application Security Events
Add Dashboard Filters
Note
Only the dashboard owner or someone with developer permissions can edit a dashboard. If you need to edit a dashboard that you do not own, you can duplicate the dashboard and edit it as needed. For information on duplicating, see Duplicate a Dashboard.
Dashboard filters enable viewers to explore different data perspectives. The filter types that you can create depend on the data models used by the visualizations on your dashboard. When you create a filter for a data dimension, you can apply it to any of the visualizations that use the dimension. When applied, dashboard filters override any internal filter settings.
Important
If your dashboard includes visualizations built from Event Store data, we recommend adding an Approx Log Time filter to the dashboard so that users can override the internal Approx Log Time filters that are automatically attached to these visualizations. By default, internal Approx Log Time filters are set to display only data from the last two days to avoid slow loading times. Adding an Approx Log Time filter to the dashboard enables users to readily view data from different time ranges within your licensed retention period.
To add a dashboard filter:
Open a dashboard that you want to create a scheduled deliver for.
From the Dashboards home page, click more menu icon
for the dashboard that you want to modify, and then click Edit.The dashboard opens in edit mode.
Open the the dashboard that you want to modify and click the Edit button.
Click Add a filter.
The Add Filter dialog box displays.
Select a field for the filter, and then click Next.
Tip
Use the Search text filter to narrow the list of fields.
Select a Control from the drop-down menu.
The control that you select determines how the viewer interacts with the filter.
Note
The subsequent settings may vary depending on the control that you select.
(Optional) Select a Display from the menu.
The options available for this setting depend on the selected control.
(Optional) To make the filter Required, select the checkbox.
When a filter is set to required, it must have a value, whether a default value or one selected by the viewer. Default and available values are optional settings that are configured in the next step.
(Optional) Select the filter Value(s) and/or a Default Value.
To include all available Value(s), leave the field blank.
Important
Filters applying the is in the last operator to the Approx Log Time field yield inaccurate results when the time unit is equal to our greater than hours.
As a workaround to this issue, express time lengths in seconds or minutes.
Click Next.
Select the TILES TO UPDATE.
Tiles that are not applicable to the filter cannot be selected.
Note
To edit any of the previous settings, click the edit icon
.Click Add Filter.