DashboardDashboards Guide

Navigate to the Visualizations tab and click New Visualization in the top right corner. A Create New Visualization dropdown menu is displayed.

From inside an already open dashboard, click Edit in the top right to enter the edit mode. Then click Add Visualization at the top. A Create New Visualization dropdown menu is displayed.

Basic – Select this method to manually configure the visualization. The remaining steps in this procedure walk you through configuring the Data, Filters, and Appearance panels.

Exabeam Nova – This method is part of a set of AI-driven capabilities that let you use a natural language prompt to quickly auto-generate a custom visualization. For information about using the natural language prompt, see Auto-Create a Visualization from a Natural Language Prompt.

Click the expand arrow () to open the Data panel, if necessary.

In the Fields (X-axis) section, click the expand arrow () to open a Data Categories menu. You can select fields from any available data category. The categories you see may depend on the Exabeam products in your environment. When you've selected a data category, the menu shows a set of recommended fields and any other sets of fields available in the selected data category. When you hover over an available field, a tooltip is displayed that includes the field's Common Information Model name and a description. You can also use the Search field to help you find a specific field.

Tip

In some data sub-categories, such as Rules and Geo IP, additional expandable sub-categories are available. For example, under Rules, you can find Mitre labels, which can be expanded to show additional more specific fields such as tactic and technique.

Click on a field to select it for the visualization. You can add multiple fields based on what you want to visualize. Each selected field is added to the Data section. To reorder the selected fields, click and drag the fields into a different order.

When a field has been added to the Data panel, you can click the pivot icon () to designate the selected field as a pivot field in the visualization. To remove the pivot from a field, click the pivot icon again.

If you want to create a custom metric from one of your selected data fields, click the options icon () and select one of the available aggregation functions: Count distinct, List of unique values, Minimum, Maximum, Sum, Average. The custom metric is added to the Metrics (Y-axis) section of the Data panel.

If you want to create a custom data group from one of your selected data fields, click the options icon () and select Group. The Group By dialog box opens. Add a Custom Field Name for the new group. In the Groups section, define the conditions you want to use to group the data. For example, in the image below, the email_address dimension is being grouped by personal vs. work email addresses. Any remaining activity will be grouped under other. When you've defined the groups, click Save. The custom data group is added to the Fields (X-axis) section of the Data panel.

To remove a selected field from the visualization, click the delete icon ().

In the Metrics (Y-axis) section, click the expand arrow () to open a Data Categories menu. You can select metrics from any available data category. The categories you see may depend on the Exabeam products in your environment. When you've selected a data category, the menu shows a set of recommended fields and sets of any other metrics available in the selected data category. When you hover over an available metric, a tooltip is displayed that includes the metric's Common Information Model field name and a description. You can also use the Search field to help you find a specific metric.

Click on a metric to select it for the visualization.

To remove a selected metric from the visualization, click the delete icon ().

Required Filters – These are filters that are included automatically based on the data category you selected fields and metrics from in the Data panel. For example, if you select fields from the Events data category, the Approx Log Time field is automatically included as a filter set for 2 days. You can change the filter but not delete it. Other data categories do not include this log time filter by default, but you can add it.

Query Filters – These are filters that you can configure yourself to tailor the information displayed in the new visualization. You can configure a time range filter to show only data from a specific time period. You can configure other filters, or combinations of filters, to specify aspects of fields included in the visualization, like certain types of users or activities. Depending on how complex your filter needs to be, you can group filter conditions together with AND or OR operators.

You may not need to select a chart type if you started creating the visualization by selecting one of the chart-specific create options.

It can be helpful to click through the different chart types to preview how they appear. If the data you have selected is not compatible with a specific chart, a message is displayed to indicate the type of fields and metrics needed to use it.

For a map chart, the visualization must include a Country Code field.

For bar and column charts, you can opt to change the series positioning by selecting the desired series positioning: Grouped, Stacked, or Stacked Percentage.

Creating from the Visualizations Tab – Click Save Visualization. The visualization is created and added to the library. You can access it for viewing and editing from the Visualization tab. If you want to be able to add the new visualization to one or more dashboards at a later time, you will first need to make it public. See Make a Visualization Public.

Creating from within a Dashboard – Click Ave Visualization. The visualization is created and added to the dashboard where you started creating it. If you would like to add it to the visualization library, click the options icon () of the visualization tile on the dashboard and select Add to Library. A library icon () appears on the visualization tile next to the title.