...
...
...
...
...
...
...
...
...
...
...
...
Overview
Customers that have the relevant license can create their own Analytics Dashboards to visualise and analyse the incoming log data. This functionality is available from Snare Central v8.6.0.
...
| Table of Contents | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Dashboards Actions
...
Action items on the Analytics Dashboards page allow to:
 | Create a new empty Dashboard  Provide the following details in the dialog: Name - dashboard name (up to 254 characters) Grant full access to - select at least one of the groups the User belongs to, so that the User can access the Dashboard after its creation. Click Create. The dashboard will be added in the desired location. | |||
 | Add New Directory Provide the following details in the dialog: Name - directory name (up to 254 characters) A directory can As of version 8.6.2, a container can be created at any hierarchical level as long as the user has Change permissions to the parent container.
| |||
 | Import Dashboards Import dashboard(s) from previous export from another Snare Central | |||
 | Search dashboards and directories by name Click x in search window to clear search results. After navigating into a found directory, use Back to Search Results link in the Reports breadcrumbs area to return to your search results.  | |||
 | Sort all dashboards and directories by nameClick sort button to toggle sorting in Ascending or Descending order. | |||
 | Rename, Move, Export or Delete a dashboardby clicking the ellipsis (...) in the custom dashboard line. Rename opens a dialog that allows to change custom dashboard’s Name and Description, and move it to another parent directory Export Dashboard opens a dialog that allows to generate an export file with the dashboard definitions or send this file by email to a desired recipient (email setup needs to be configured in the Wizard) Delete opens a confirmation dialog, and if confirmed, proceeds with deletion of the dashboard and its widgets. The container/folder will be removed if it is the last dashboard to be removed. | |||
 | Rename, Export or Delete a directoryby clicking the ellipsis (...) in the directory line. Rename opens a dialog that allows to rename the directory Export Directory opens a dialog that allows to generate an export file with the definitions of all the dashboards in the directory, or send this file by email to a desired recipient (email setup needs to be configured in the Wizard) Delete All opens a confirmation dialog, and if confirmed, proceeds with deletion of all the dashboards in this directory.
|
Creating Dashboard Content
After the dashboard is created with pre-set layout, small empty layout items are placed on the canvas. These items can be resized, dragged and drop, added or deleted.
...
Add Layout Item
...
This button on top-right of the dashboard allows to add additional empty dashboard layout items on the canvas.
Maximum of 50 items are allowed on one dashboard.
Resize Layout Item
Item can be resized using the mouse: press on the bottom-right corner of the layout item and drag to the desired size. The item will snap to the underlying grid.
Click Save Layout floating button in the bottom-right corner to save layout changes.
Drag & Drop Layout Item
Item can be dragged and dropped to any place on the dashboard layout using the mouse: press on the header area of the layout item and drag it to the desired location. The item will move to the new location, and other items will move aside to make space for it.
Click Save Layout floating button in the bottom-right corner to save layout changes.
Delete Layout Item
Click 
at the top-right corner of the item to open the Action Menu.
Select Delete Item.
In the confirmation dialog, select either Delete or Cancel.
Add Widget
...
It is time to put some content on the dashboard!
...
After selection of the Widget Type, additional fields will appear. Configure the widget as described below.
Click Add to add the widget.
Configure Bar / Line / Pie Chart
...
Bar and Line Charts plot number of events matching the query, grouped by a certain field.
X axis represents event time, with granularity of 15 minutes.
...
To create a link, select this checkbox, then select existing widget(s) to link (drill down) to.
Configure Status Card
...
Status Card displays a color-coded counter of events matching the query.
...
Configure Threshold - value in the status card is colour-coded according to the configured “Warning” and “Problem” thresholds:
red - value is equal to or exceeds the “Problem” threshold
orange - value is equal to or exceeds the “Warning” threshold, but is lower than the “Problem” threshold
green- value is under the “Warning” threshold
...
To create a link, select this checkbox, then select existing widget(s) to link (drill down) to.
Configure Table
...
Events Table has no query of is own. Its purpose is to display log data from other widgets, based on user selection. Action items on top of the table allow to configure visible columns and export table data to CSV.
Pagination controls are found at the bottom of the table.
...
To create a link, select this checkbox, then select existing widget(s) to link (drill down) from.
Edit Widget
Click at the top-right corner of the created widget to open the Action Menu.
Select Edit Widget. This will open the widget configuration dialog with options specific to the widget type, as described above. Edit the options and click Edit button to save changes.
Delete Widget
Click at the top-right corner of the created widget to open the Action Menu.
Select Delete Widget. This will open theconfirmation dialog, and if confirmed, will proceed with deletion of the widget, leaving an empty layout item.
Efficient Dashboards Design
Dashboards are a powerful tool for visualising incoming data in near-real time, recognising threats and issues early and acting on them. However, types and volumes of incoming logs may affect dashboard efficiency.
...
Configure widget’s monitored time period to be shorter, for example “Last 1 hour” instead of “Last 7 days”
Configure chart's Top N categories to be smaller, for example “Display top 5 systems”
Narrow down the search query with more precise search parameters
Optimise query syntax
Queries Optimization
When using the event search queries you can be generic with searching for data or more precise. The more precise you are the faster the query will be. Running a query using the basic mode maybe fine for some searches but others will require an advanced search to be constructed. Using a more precise search can be orders of magnitude faster as it will use the indexes and cache information better and also incur less regex searching along the event strings to look for the target information.
...