Adding Content to a Dashboard
  • 31 Aug 2022
  • 8 Minutes to read
  • Dark
    Light

Adding Content to a Dashboard

  • Dark
    Light

Article Summary

To add a card to a dashboard, click the Add Your First Card box in the middle of the dashboard (for newly created dashboards), or click the plus icon at the upper-right corner of the Dashboard screen. The Add New Card drawer will be displayed with the Details step selected (Figure 1). Enter a title for the card in the Card Title box, if desired.

Note
If you do not enter a title in the Card Title box, the name of the selected card type (e.g., My Recent History) will be set as the card’s title.

Graphical user interface, application  Description automatically generated

 

There are three kinds of cards that can be added to a dashboard: Widget, Metric, and Query.

Widget Card

Widget cards are predefined and cannot be configured, other than to adjust their size and position on the dashboard. Click on a type of Widget card and it will be added to the dashboard.

Note
Scroll down the Widget section of the Add New Card screen to view the full list of Widget cards.

For example, the Sources Widget card, which displays a graphical representation of all Organizations, Communities, and Sources by Threat Rating and Confidence Rating of their Indicators, was added to the dashboard in Figure 2. Hover the cursor over an area on the graph to view a tooltip with specific information about the data represented there.

Chart, bar chart, histogram  Description automatically generated

 

Metric Card

There are four types of Metrics available for display on dashboard cards: System Metrics, User Metrics, Cases Metrics, and Playbooks Metrics.

Note
Scroll down the Metric section of the Add New Card screen to view the full lists of Cases Metrics and Playbooks Metrics.

System Metrics are predefined by ThreatConnect and divided into three categories:

  • Activities provides a graphical representation of changes in activity (e.g., Observations, False Positives, Tags, Attributes, Average Indicator Confidence Rating) within the selected owners over a period of time.
  • Indicators provides a graphical representation of the addition of five types of Indicators (URL, Email Address, File, Host, and Address), as well as enriched Indicators, within the selected owners over a period of time.
  • Intelligence provides a graphical representation of the addition of Groups within the selected owners over a period of time.

User Metrics are created by Organization Administrators. See the ThreatConnect Organization Administration Guide for more information. In addition, see the Custom Metrics page of the v2 ThreatConnect API documentation for information about how to retrieve, create, and delete custom Metrics via v2 of the ThreatConnect API.

Cases Metrics provide a graphical representation of nine metrics for Workflow Cases that exist in your Organization: Active Cases, Analyst Workload, False Positives, Mean Time to Detection (MTTD), MTTD Average, Mean Time to Resolution (MTTR), MTTR Average, Top 10 Case Closing Analyst, and Unassigned Cases.

Playbooks Metrics provide a graphical representation of three metrics calculated by the Playbooks Return on Investment feature for all selected Playbooks: Playbook Execution Count, Playbook Financial Savings, and Playbook Hours Saved.

Customizing a Metric Card

  1. Click on a Metric listed in the Details step of the Add New Card screen. The Query step will be displayed (Figure 3). Configure the data for the card.

    Graphical user interface, application  Description automatically generated

     

    • Owners: Select the owner(s) whose data are to be displayed on the card. Keep the Inherit owner selections from My Intel Sources slider toggled on to use all available owners. If any owner is deselected, the slider will automatically toggle off (gray).
      Note
      A My Orgs list will be displayed in place of the View <Organization name> slider for Super Users, which allows them to select the Organizations whose data are to be displayed on the card.
      Note
      You can select a single owner by hovering over the owner’s name and clickingIcon  Description automatically generatedonly displayed to the right of the owner's name.
    • Sum Across Owners: Multiple metric types must be summed across all selected owners. This feature may be disabled (by toggling the slider off) if only one type of item in the Types menu or a single date from the Date Range menu has been selected.
    • Types: Select which types of data should be displayed.
    • Date Range: Select a date range for which data should be displayed.
    • Date Order: Select whether the date should be displayed in ascending or descending order.
    • Short Date Format: For charts that display dates, toggle the slider on (orange) to display the dates in short date format.
    • Card Preview: This section displays a preview of the card.
    • Chart Type: Select the type of chart to display.
    • Click the NEXT button.
  2. The Options step will be displayed (Figure 4). Configure the look of the card.

    Graphical user interface, application  Description automatically generated

     

    • Color Scheme: Select the color scheme for the card.
    • Scheme Type: Select whether the color scheme should be ordinal or linear. This option is displayed only for types of charts for which it is relevant.
    • Chart Configuration Checkboxes: Use the checkboxes to customize the look of the chart. The available options change depending on the type of chart selected in the previous step. In this example (sparkline chart), the Disable Tooltips checkbox is the only element in this section, but if, for example, a line chart is selected in the previous step, then checkboxes for configuring the chart’s axes, legend, gridlines, and gradient will also be displayed.
    • Card Width: Enter a number for the card’s width.
    • Card Height: Enter a number for the card’s height.
    • Click the SAVE button.
  3. The card will now be displayed on the dashboard (Figure 5). Hover the cursor over an area on the graph to view a tooltip with specific information about the data represented there. (This functionality will not be available if the Disable Tooltips checkbox has been selected.)

    Chart  Description automatically generated

     

Query Card

Query cards display the results of ThreatConnect Query Language (TQL) queries. See the "Query Features" section of The Browse Screen for more information on how to create and save queries.

Customizing a Query Card

  1. Choose New Query or one of the Saved Queries listed in the Queries step of the Add New Card screen (Figure 1). The Query section will be displayed (Figure 6). Configure the data for the card.

    Graphical user interface, application  Description automatically generated

     

    • Owners: Select the owner(s) whose data are to be displayed on the card. Keep the Inherit owner selections from My Intel Sources slider toggled on (blue) to use all available owners. If any owner has been deselected, the slider will automatically toggle off (gray).
      Note
      If creating a Query card for Cases or Case Tasks, toggle the Inherit owner selections from My Intel Sources slider off, clear all selections under Intel Sources and My Communities, and leave the View <Organization name> slider toggled on in order to circumvent permissions errors.
      Note
      A My Orgs list will be displayed in place of the View <Organization name> slider for Super Users, which allows them to select the Organizations whose data are to be displayed on the card.
      Note
      You can select a single owner by hovering over the owner’s name and clickingIcon  Description automatically generateddisplayed to the right of the owner's name.
    • Display Type: Select whether the query should be displayed as a Chart or a Datatable.
    • Query By: Select the type of object that should be queried.
    • Advanced Query: Enter a TQL string to run an advanced query.
      Important
      When writing a TQL string that includes an OR clause in the Advanced Query field, enclose the entire query in parentheses to ensure that the query condition is maintained when viewing the Browse screen for a selected chart element displayed on the Query card.
      Note
      Super Users can construct TQL strings that search for objects belonging to multiple Organizations. See the “Query for Objects Belonging to Multiple Owners” section of Constructing Query Expressions for more information.
    • Grouping:
      • Use the dropdown menu on the left to group the results by Top or Bottom.
      • Enter the number of results to display (e.g., Top 25; Bottom 10).
      • Use the dropdown menu on the right to select the type of results to display.
    • Include “Other”: Select this checkbox to include an “Other” category that groups together the rest of the results outside of the selections made in the Grouping section. For example, if Top 10 Tags has been selected in the Grouping section and the Include “Other” checkbox is selected, then in addition to the 10 Tags, there will be an “Other” element (e.g., a bar in a bar graph) that aggregates the results of the remaining Tags.
    • Aggregate: This dropdown menu allows you to aggregate Attributes across Sources in ThreatConnect, so that, for example, they can rate Groups in a Source. For integer-type Attribute Types, these are the available aggregations: AVG, MIN, MAX, and SUM. For non-integer Attribute Types, COUNT is available as an aggregation.
    • Target: This dropdown menu displays the intel item that can be aggregated. For example, you can select the aggregation AVG of Confidence Ratings.
    • Card Preview: This section displays a preview of the card.
    • Chart Type: Select the type of chart to display.
    • Click the NEXT button.
  2. The Options step will be displayed (Figure 7). Configure the look of the card.

    Graphical user interface  Description automatically generated

     

    • Color Scheme: Select the color scheme for the card.
    • Scheme Type: Select whether the color scheme should be ordinal or linear. This option is displayed only for types of charts for which it is relevant.
    • Chart Configuration Checkboxes: Use the checkboxes to customize the look of the chart. The available options change depending on the type of chart chosen in the previous step.
    • Card Width: Enter a number for the card’s width.
    • Card Height: Enter a number for the card’s height.
    • Chart Configuration Spinners: Enter a number for the chart element’s dimensions. The available options change depending on the type of chart selected in the previous step. In this example (vertical bar chart), the Bar Gap Size spinner is the only element in this section, but if, for example, a gauge chart is selected in the previous step, then checkboxes for configuring a number of elements, including the minimum, maximum, and start angle, will also be displayed. For other types of charts, there are no elements in this section.
    • Click the SAVE button.
  3. The card will now be displayed on the dashboard (Figure 8). Hover the cursor over an area on the graph to view a tooltip with specific information about the data represented there. (This functionality will not be available if the Disable Tooltips checkbox has been selected.)

    Chart  Description automatically generated

     


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20044-04 v.15.A


Was this article helpful?