Configure visualization settings: 

• Panel Use the Panel tab to specify a panel title and to select a visualization type and data fields, among other options. See Panel Settings.

• Field Use the Field tab to define options for rendering data fields in the visualization. See Field Settings.

• Advanced: Use the Advanced tab to define options for specific fields that you want to be different from the settings defined on the Fields tab. See Advanced Settings.

Add to Dashboard: After you have customized the visualization as desired, click Add to Dashboard and configure the settings to add the visualization as a panel in a new or existing dashboard.

Select a visualization type to display your data. See About AQL Visualization Types for descriptions of available visualization types.

All visualization types support OCSF Version 1.2 fields with dotted notation. See OCSF Schema Overview for more information.

• Unit

• Min

• Max

• Decimals

• Display name

• No value

• Color scheme

Click +Add link and complete settings for link behavior when a user clicks data fields in the visualization.

You can use the following URL types and configure them to pass variables:

• Relative URL – URL that will open a new Search page with a specified search query.

• URL in ThreatStream or Security Analytics domains – URL that will open a page or a specific object in ThreatStream or Security Analytics.

You can use a relative URL in either of the following ways:

• Specify /xdr/gf/m/a/?query= in the URL field, and then provide a search query. Then, type a dollar-sign ($) to display a list of variables that you can insert into the query.

• Specify /xdr/gf/d/ in the URL field, then directly type a dollar-sign ($) to use a reference to different variables in the dashboard.

To use a URL in ThreatStream or Security Analytics domains, do the following:

1. Type a dollar-sign ($) in the URL field to display a selection list of variables that can be inserted into the URL pattern, and then select Domains Threatstream or Domains Security Analytics.

2. Using a forward slash ("/"), specify the page or a link to an object in ThreatStream or Security Analytics, and then click Save.

   

   In the example above, clicking on any part of the visualization opens the Investigations page in ThreatStream.

Add link to another dashboard

To use the data in a dashboard panel as context for navigating to a different dashboard and populating its panels in ThreatStream or Security Analytics:

1. Go to the Dashboard library, open your target dashboard, and click the Share dashboard or panel icon () on the top-left.

2. Copy the Link URL displayed on screen. This is the URL for the target dashboard.

3. On your current dashboard, in the Edit link form, paste the Link URL you obtained in Step 2.

4. After the target dashboard ID, enter the /? symbols, then the string var-, followed by the dashboard variable and its value that you would like to use as context to link your current dashboard to the target dashboard and populate its panels.

5. Enter a title for the target dashboard. Optionally, enable the Open in new tab switch to ensure the target dashboard opens in a new tab.

6. Click Save.

When done correctly, the data link would have the following formats:

Single variable: Single context variable with its value.

<domain_you_selected>/xdr/gf/d/id-of-the-target-dashboard/?var-<my-context-variable>=<my-context-variable-value>

Multiple variables: Multiple context variables and their corresponding values, separated by ampersand (&).

<domain_you_selected>/xdr/gf/d/id-of-the-target-dashboard/?var-<my-context-variable1>=<my-context-variable1-value>&var-<my-context-variable2>=<my-context-variable2-value>

In the example in the screenshot above, clicking on a linked dashboard panel will carry the context through hostname=aws_vpc_dns to the target dashboard with dashboard ID = 5468efc3-0bnm-9687-6f84-91aae23478dd, and populate its panels with information related to aws_vpc_dns.

Alternatively, instead of entering the value in Step 4, you can also type a dollar-sign ($) in the URL and use the reference to the field. Using hostname from the aforementioned example and referencing its value, the data link becomes:

https://ui.threatstream.com/xdr/gf/d/5468efc3-0bnm-9687-6f84-91aae23478dd/?var-hostname=${__data.fields.hostname}