About the Text Visualization Type

Use the Text visualization type to add a dashboard panel that accepts Markdown-formatted input text.

(Click the image to enlarge it.)

Use case

You can use the Text visualization to:

  • Add instructions, descriptions, or reports about using different panels in the dashboard, leading to detailed and well-documented dashboards.

  • Capture important contextual information or warning messages you must know to accurately use the dashboard, its workflows, or drilldown capabilities, to name a few.

  • Share confidential banners that carry critical information intended for only certain groups of users, helping in dashboard user management.

  • Embed images, code snippets, and hyperlinks to create highly informative dashboards that can support documentation and training purposes.

Panel Options

Use the options in the Panel tab to customize the options described in the following table.

Setting   Description
Settings Panel title Titles appear at the top of a panel.
Description Descriptions appear as tooltips. Markdown and links are supported.
Transparent Display panel without a background.

Field Options

Use the options in the Fields tab to customize the options described in the following table.

Setting   Description
Data links Add link

Click +Add link and complete settings for link behavior when a user clicks data fields in the visualization.

You can use the following URL types and configure them to pass variables:

  • Relative URL – URL that will open a new Search page with a specified search query.

  • URL in ThreatStream or Security Analytics domains – URL that will open a page or a specific object in ThreatStream or Security Analytics.

You can use a relative URL in either of the following ways:

  • Specify /xdr/gf/m/a/?query= in the URL field, and then provide a search query. Then, type a dollar-sign ($) to display a list of variables that you can insert into the query.

  • Specify /xdr/gf/d/ in the URL field, then directly type a dollar-sign ($) to use a reference to different variables in the dashboard.

To use a URL in ThreatStream or Security Analytics domains, do the following:

  1. Type a dollar-sign ($) in the URL field to display a selection list of variables that can be inserted into the URL pattern, and then select Domains Threatstream or Domains Security Analytics.

  2. Using a forward slash ("/"), specify the page or a link to an object in ThreatStream or Security Analytics, and then click Save.

    In the example above, clicking on any part of the visualization opens the Investigations page in ThreatStream.

Add link to another dashboard

To use the data in a dashboard panel as context for navigating to a different dashboard and populating its panels in ThreatStream or Security Analytics:

  1. Go to the Dashboard library, open your target dashboard, and click the Share dashboard or panel icon () on the top-left.

  2. Copy the Link URL displayed on screen. This is the URL for the target dashboard.

  3. On your current dashboard, in the Edit link form, paste the Link URL you obtained in Step 2.

  4. After the target dashboard ID, enter the /? symbols, then the string var-, followed by the dashboard variable and its value that you would like to use as context to link your current dashboard to the target dashboard and populate its panels.

  5. Enter a title for the target dashboard. Optionally, enable the Open in new tab switch to ensure the target dashboard opens in a new tab.

  6. Click Save.

When done correctly, the data link would have the following formats:

Single variable: Single context variable with its value.

Copy 
<domain_you_selected>/xdr/gf/d/id-of-the-target-dashboard/?var-<my-context-variable>=<my-context-variable-value>

Multiple variables: Multiple context variables and their corresponding values, separated by ampersand (&).

Copy 
<domain_you_selected>/xdr/gf/d/id-of-the-target-dashboard/?var-<my-context-variable1>=<my-context-variable1-value>&var-<my-context-variable2>=<my-context-variable2-value>

In the example in the screenshot above, clicking on a linked dashboard panel will carry the context through hostname=aws_vpc_dns to the target dashboard with dashboard ID = 5468efc3-0bnm-9687-6f84-91aae23478dd, and populate its panels with information related to aws_vpc_dns.

Alternatively, instead of entering the value in Step 4, you can also type a dollar-sign ($) in the URL and use the reference to the field. Using hostname from the aforementioned example and referencing its value, the data link becomes:

Copy 
https://ui.threatstream.com/xdr/gf/d/5468efc3-0bnm-9687-6f84-91aae23478dd/?var-hostname=${__data.fields.hostname}

Advanced Options

Use the options in the Advanced tab to override the settings configured in the Fields tab for particular fields. For example, you can override the automatic color palette selected for a particular field to a preferred single color.

You have the following options to select field settings to be overridden:

  • Fields with name: Set properties for a specific field.

  • Fields with name matching regex: Set properties for fields with names matching a regex.

  • Fields with type: Set properties for fields with a specific type (numeric, string, Boolean).

  • Fields returned by query: Set properties for fields from a specific query.

Once you add this visualization type to your dashboard, you can also manage your dashboard panels.

See Manage dashboard panels to learn more about how you can edit panel settings to modify the visualization and apply advanced transformations, share panels with permitted users in your organization, or even view the panel JSON model, and so on.

Support for Variables

The Markdown widget also supports dynamic variables on Anomali Match Dashboards. You can now insert both system-defined and custom variables into Markdown content, enabling the display of dynamic, context-sensitive information (for example, usernames, dates, alert counts) that updates automatically based on AQL data or user-defined inputs.

How to use variables

Variables can be inserted into your Markdown content using double curly braces:

${enter_your_variable_name}

When the widget is rendered, these placeholders are replaced with their corresponding values.

Adding a variable

See Adding Dashboard Variables to understand how you can add and configure variables.

Dynamic Usage of Variables

After Adding a variable on a dashboard, you can dynamically display their context-specific values as follows:

  1. Click Edit on the dashboard.

  2. Hover your mosue to the right of the Panel title and click the expander. Doing so displays the panel management menu.

  3. Click Edit.

  4. In the Content Editor, enter the dollar sign ($). This sign displays all the system and custom variables that you can use to dynamically display context-specific information. In the example below, we add variables for dcid, event time, sourcetype, and time range.

  5. Click Save.

Once you complete these steps, the variable you added will be dynamically populated with its value(s), based on AQL data or user-defined inputs.