Auto-Create a Visualization from a Natural Language Prompt

Visualizations are stored in a visualization library and can be used in multiple dashboards. You can create new visualizations either as independent entities, which can later be added to a dashboard, or as part of an existing dashboard.

Note

For examples of the different types of visualizations you can add, see Chart Types.

There are multiple ways to create a custom visualization in the Dashboards application. This topic describes using the Exabeam Nova method and its set of AI-driven capabilities to quickly auto-create a visualization from a natural language prompt. Alternately, you can manually create a visualization using the Basic method, duplicate an existing visualization and then modify it, or generate a visualization from a Search query.

If the automatically generated visualization does not produce the data you want to visualize, you can still switch to the Basic mode and manually modify the visualization settings to produce exactly the desired results.

Note

This auto-create option is currently available to create visualizations for the following data models only:

Event
Alerts (You must be using Threat Center to access the Alerts data model)
Anomaly Fields

Overview of the Create a Custom Visualization Page

Create a Custom Visualization is an authoring page that provides a single pane for building and previewing a custom visualization to your exact specification. On the left side of the page, you can

make decisions about which data fields to display and how to measure them, how to filter the data display, and what charts to use. As you make decisions on the left to build your visualization, you can preview the results on the right, viewing either by the data or the chart, or by both.

The Create a Custom Visualization authoring page includes several main sections, as shown in the following image and described in the numbered points below.

Use the tabs at the top of the page to select the Exabeam Nova authoring method. At the end of the visualization creation process, you can also click the options menu () and select View SQL. A dialog box opens and displays an SQL version of the visualization that you can view or copy.
Enter a natural language prompt in this field and click the auto-create icon () to generate the data table and chart preview of your custom visualization.
Click Recent Prompts to show a list, in the panel below, of previously entered prompts in the natural language prompt field.
Click Example Prompts to show some examples, in the panel below, of different types of prompts you can use to create or pattern your own prompts.
This panel shows either a list of recently entered natural language prompts or a set of example prompts to help you get started on writing your own prompt.
Use the options to control how you preview the visualization results. Options include Data Preview, Chart Preview, or Both.
This panel previews what the chart will look like in your custom visualization.
This panel previews a table of the data included in the visualization you're building.
Click Save Visualization if you're satisfied with the auto-generated visualization and want to save it.
Note
If you want to add a title to the visualization before saving it, switch to the Basic mode and add a title in the Appearance panel. You can also switch to Basic and configure additional Filters.

For more detailed step-by-step information, see Auto-Generate Method to Create a Custom Visualization below.

Auto-Generate Method to Create a Custom Visualization

To auto-create a visualization from the natural language prompt:

Enter the visualization creation process – You can start creating a custom visualization either as a stand-alone entity (form the Visualization tab) or as part of an existing dashboard. To get started, enter the creation process in one of the following ways:
- Navigate to the Visualizations tab and click New Visualization in the top right corner. A Create New Visualization dropdown menu is displayed.
- From inside an already open dashboard, click Edit in the top right to enter the edit mode. Then click Add Visualization at the top. A Create New Visualization dropdown menu is displayed.
From the Create New Visualization dropdown menu, select Create New or one of the chart-specific options. The chart-specific options pre-select the chart type for the new visualization and provide insight into the data fields and metrics you need to include.
When you have selected an option, the Create a Custom Visualization window opens.
Select the Exabeam Nova method for creating the visualization – In the Create a Custom Visualization window, there are two main methods for building a custom visualization, represented by two tabs in the top left of the page:
- Basic – This method is useful for manually defining a visualization from scratch, or for fine-tuning an auto-generated visualization. It includes panels for configuring the Data, Filters, and Appearance of the visualization.
- Exabeam Nova – This method is part of a set of AI-driven capabilities that let you use a natural language prompt to quickly auto-generate a custom visualization. The remaining steps in this procedure walk you through the auto-generation process.
Write a natural language prompt – Enter your visualization criteria in plain language in the prompt field. For best results, include a data category, a metric, fields for grouping, a timeframe, and a chart type.
Examples:
- Show the count of events grouped by hostname for the last 24 hours in a bar chart
- Show the count of alerts grouped by priority over the last 7 days as a pie chart
If you need some help getting started writing your natural language prompt, click on either Recent Prompts or Example Prompts to display some suggestions. You can click on any recent or example prompt to enter it into the prompt field. Then you can make modifications to tailor the prompt language to fit your specific need.
Auto-create the visualization preview – When you're satisfied with the natural language prompt you've entered, click the auto-create icon () next to the prompt. A data table is generated and a preview of the visualization is displayed on the right side of the page. You can choose to view only the data table, only the chart, or both the table and the chart. The number of rows returned in the visualization is listed in the top right corner above either the chart or the data table.
Modify in Basic mode – If you want to modify the visualization further, you can switch to the Basic authoring mode and manually change any of the fields, metrics, filters, or chart type. Then click Update Preview to re-generate the visualization data. For information about manually configuring visualization settings, see Create a Visualization Using the Basic Method.
Note
When you modify the visualization in Basic mode, and then switch back to the Exabeam Nova mode, a note is displayed under the natural language prompt field as a reminder that the prompt no longer reflects the changes to your visualization preview.
Add a Title – Switch to the Basic mode and expand the Appearance panel on the left. Click in the Title field and replace the placeholder text with a descriptive title, as in the following example:
Save the visualization – To complete the visualization, do one of the following, depending on where you started creating it:
- Creating from the Visualizations Tab – Click Save Visualization. The visualization is created and added to the library. You can access it for viewing and editing from the Visualization tab. If you want to be able to add the new visualization to one or more dashboards at a later time, you will first need to make it public. See Make a Visualization Public.
- Creating from within a Dashboard – Click Ave Visualization. The visualization is created and added to the dashboard where you started creating it. If you would like to add it to the visualization library, click the options icon () of the visualization tile on the dashboard and select Add to Library. A library icon () appears on the visualization tile next to the title.