NW: Setting Up Dashboards

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by Susan Ewald on Oct 18, 2017
Version 6Show Document
  • View in full screen mode
  

A dashboard is a group of dashlets that give you the ability to view in one space, the key snapshots of the various components that you consider important. In NetWitness Suite, you can compose dashboards to obtain high-level information and metrics that portray the overall picture of a NetWitness Suite deployment, displaying only the information that is most relevant to the day-to-day operations.

By default, the NetWitness Suite default dashboard is displayed when you log in to NetWitness Suite, and it is populated with a few useful dashlets to get you started with your own customizations. The dashboards for all NetWitness Suite components are available to add to the default NetWitness Suite dashboard or a custom NetWitness Suite dashboard.

You can view dashboards and reports on different areas of interest depending on your user permissions. You have the option to select a preconfigured dashboard, import a dashboard, or create your own custom dashboard. The dashboards help you to quickly and easily view reports. You can configure your dashboards to display the information that supports your workflow. This topic explains the high-level tasks that can be done when you are setting up a dashboard.

Dashboard Basics

If the Monitor view is your default landing page following logging in to NetWitness Suite you will always see either the default dashboard or the currently configured dashboard immediately after completing the login process. To return to the dashboard from another NetWitness Suite component, go to Monitor > Overview.

Dashboard Title

The dashboard title reflects the currently active dashboard; for example, Default Dashboard.

Image of Default Dashboard title

Dashboard Selection List

You can access preconfigured and custom dashboards on the dashboard selection list. When you select a dashboard, its title is displayed below the NetWitness Suite toolbar.

Image of dashboard selection list

A dashboard has:

  • The dashboard toolbar
  • The dashboard title and the dashboard selection list.

Dashboard Toolbar

The dashboard toolbar is available next to the title of the selected dashboard. The dashboard toolbar allows various operations on dashboards and dashlets.

Image of the dashboard toolbar

Note: The Copy, Delete, Import, Export, Share, and Add Row options are disabled for preconfigured dashboards.

                                                   
OptionDescription

Image of the Favorites icon

Sets the selected dashboard as the Favorite.

Image of the dashboard title/dashboard selection drop-downDisplays the list of available dashboards from which you can make a selection.

Plus sign icon for adding a dashboard or a dashlet

Displays the Create a Dashboard dialog, where you define or add a custom dashboard.

Minus sign icon for deleting a dashboardDeletes a custom dashboard. The default dashboard cannot be deleted.

Icon for copying a dashboard

Allows you to copy a dashboard.

Dashboard settings iconDisplays the Manage Dashlet dialog.
Export dashboard iconExports a dashboard as a .zip file.
Import dashboard iconImports a dashboard as .zip or.cfg file.

Image of Share control to share a dashboard

Allows you to share a dashboard with another user.

Image of Add Row control

Enables user to add rows and columns to the dashboard based on the requirement. Click the Plus sign icon for adding a dashboard or dashlet. icon in a row to add a dashlet.

The Default Dashboard

The default dashboard is configured to display specific dashlets in specific positions. The default dashboard serves as an example of dashboard composition and a starting point for customization.

  • You can customize the information on the default dashboard by editing, adding, moving, maximizing, and deleting dashlets.
  • After modifying the default dashboard, you can restore the default dashboard (Icon to restore a dashboard) to its original layout.
  • The default dashboard cannot be deleted or shared.

Selecting a Preconfigured Dashboard

On installation of NetWitness Suite Suite, the following preconfigured dashboards are automatically activated and are available to you:

  • Default
  • Identity
  • Investigation
  • Operations - File Analysis
  • Operations - Logs
  • Operations - Network
  • Operations - Protocol Analysis
  • Overview
  • RSA SecurID
  • Threat - Hunting
  • Threat - Malware Indicators
  • Threat - Intrusion
  • Threat - Malware Indicators

You cannot perform the following actions on a preconfigured dashboard:

  • Edit a dashboard
  • Export a dashboard
  • Share a dashboard
  • Delete a dashboard

For more information on each Preconfigured dashboard, see the Dashboards Catalog in the RSA Content space on RSA Link.

Enabling or Disabling Dashboards

When you enable or disable a dashboard, all the dashlets within the dashboard are enabled or disabled along with the associated charts, unless they are used in any other dashboard.

NetWitness Suite modules can display only those dashlets presented in the Manage Dashlet dialog. The main dashboard offers all NetWitness Suite dashlets. This is an example of currently available dashlets.

Manage Dashboards dialog

                                   
NameDescription
Dashboard ListDisplays a list of the default, preconfigured, and custom dashboards.
Enable iconDisplays if the selected dashlet is enabled.
Disable iconDisplays if the selected dashlet is disabled.
TitleDisplays the title of the selected dashlet and you can also rename the dashaboard.
Past HoursDisplays the time for which the data is collected.
Dashlet Refresh Intervals (Minutes)Displays the refresh interval time of a dashlet.

Enabling a Dashboard

If you select a dashboard that is not enabled, a masked screen is displayed.

When a dashboard is disabled, a masked screen is displayed.

To enable one or more dashboard(s):

  1. Navigate to the dashboard to be enabled.

  2. In the dashboard toolbar, click Dashboard settings icon.

  3. Select the Manage Dashboard option.
    The Manage Dashboards dialog is displayed.
    Manage dashboards dialog
  4. From the dashboard list, select the dashboard(s) to be enabled.

  5. Click the Enable checkbox.

  6. Click Save.

Disabling a Dashboard

To disable one or more dashboard(s):

  1. Navigate to the dashboard to be disabled.

  2. In the dashboard toolbar, click Setting icon.

  3. Select the Manage Dashboard option.
    The Manage Dashboards dialog is displayed.
    Use this option to disable a dashboard
  4. From the dashboard list, select the dashboard(s) to be disabled.

  5. Click the Disable checkbox.
  6. Click Save.

Setting a Dashboard as a Favorite

To customize the views in NetWitness Suite, you can set a preconfigured or custom dashboard as a Favorite. The NetWitness Suite dashboard, as the name suggests, offers all NetWitness Suite dashlets. The Favorite dialog sets a specific dashboard as your favorite dashboard and will be listed as favorite every time you log in to NetWitness Suite.

  1. Navigate to any dashboard.

  2. In the dashboard toolbar, click Favorites icon.

    If the favorite icon is red in color, it indicates that selected dashboard is set as a Favorite and is listed on top above the line.

Creating Custom Dashboards

You can create custom dashboards to serve a particular purpose; for example, to represent a specific geographical or functional area of the network. Each custom dashboard is appended to the dashboard selection list.

To create a custom dashboard:

  1. In the dashboard toolbar, click Plus sign icon to add a dashboard.
    The Create a Dashboard dialog is displayed.
    Create a Dashboard dialog
  2. Enter a title for the new dashboard and click Create.
    The new dashboard is displayed as a blank screen.
    New dashboard with blank screen.
  3. Add rows to the dashboard, which can contain one or more columns, using the Add Row (Add row control) control on the right side of the screen. Just click on the desired column configuration in the drop-down list to add one row to the dashboard with the selected number of columns. Repeat the process to add more rows.
    New dashboard with rows added.
  4. You can now add any desired dashlets to the dashboard by click the Plus sign icon for adding a dashlet to a row in a dashboard. in an empty placeholder in a row. For complete details on adding and managing dashlets, see Working with Dashlets.

Once custom dashboards are created, you can:

  • Switch between dashboards by selecting an option from the dashboard selection list
  • Delete any custom dashboard
  • Import or export a dashboard

Each dashboard has:

  • The dashboard toolbar
  • The dashboard title and the dashboard selection list
  • Zero or more dashlets

Working with Dashlets

NetWitness Suite uses dashlets to display focused subsets of system information, services, jobs, resources, subscriptions, rules, and other information.

The controls for a dashlet are in the title bar. All dashlets use a common set of controls, and only those that apply to the particular dashlet appear in the title bar of the dashlet.
An example of a Dashlet.

The following table displays the description of each icon on the dashlet.

                                                     
IconNameDescription
Vertical collapse iconCollapse verticallyCollapses the dashlet vertically so that only the title is visible.
Reset size iconExpand verticallyExpands the dashlet to its original size.
Reload iconReloadReloads the dashlet.
Settings iconSettingsDisplays configurable settings for the dashlet.
Maximize size iconMaximizeIn some dashlets with content that does not fit horizontally within the width of the dashlet, maximizes a chart or a dashlet to full screen.
Delete dashlet iconDeleteDeletes the dashlet from the dashboard.

Last Refreshed at

 

Displays the time at which the data is polled from the related chart.

View More 

When clicked, navigates to the corresponding dashboard which is linked to the main dashlet and displays more details. If you have not linked the dashboard to an existing dashlet, this link with not be available on the dashlet. To configure this option, click Settings icon, and in the Dashboard Link field select a related dashboard view more details of the specific dashlet.

Note: This feature is only available for the realtime chart dashlet and the preconfigured dashboards in NetWitness Suite 11.0 or later.

You can add dashlets to the default dashboard or construct a custom dashboard with your own useful set of dashlets to make your workflow more efficient.

Add a Dashlet

To customize the views in NetWitness Suite, you can add dashlets to a default dashboard or create custom dashboards. However, you cannot add dashlets to preconfigured dashboards.

To add a dashlet:

  1. Navigate to any dashboard or create a new dashboard.
    New dashboard with empty rows.
  2. Click Plus sign icon for adding a dashlet. on the placeholder where you want to add the dashlet.
    The Add a Dashlet dialog is displayed.
    Add dashlet screen with a drop-down menu.
  3. Click on the Dashlet Type selection list to view the available dashlets, and select the type of dashlet you want to add. Depending on the type of dashlet you are adding, some configurable fields will be displayed in the Add a Dashlet dialog.
  4. Type a title for the dashlet. The title can include letters, numbers, special characters, and spaces.
  5. If there are additional configurable fields for the dashlet, set appropriate values.
  6. When all required fields have been configured, click Add.
    The dashlet is added to the dashboard in the selected placeholder and is automatically saved.
    Dashboard with dashlets added

Edit Dashlet Properties

All preconfigured dashlets are read-only and their properties cannot be edited. Other dashlets are editable and allow users to customize some aspect of the data displayed in the dashlet. A dashlet with editable properties has a settings (Settings icon) option that displays all the editing options. 

After the dashlets are added, you can drag and drop them and they can be swapped.

A dashlet without editable properties, such as the Live Subscriptions dashlet, does not display the settings option in the title bar. Many dashlets have an editable title where you can edit the following properties:

  • Dashlet display title.
  • Type of services to monitor; for example, you can monitor only Decoders, or you can monitor Decoders and Concentrators.

Other dashlets have parameters that you define to specify the kind and amount of information you want to see in the dashlet. For example, a Realtime Chart Dashlet has the settings option.

  1. To display and modify the options for a dashlet, click settings (Settings icon) in the dashlet title bar.
    The Options dialog is displayed.
    Options dialog
  2. Edit any of the displayed properties. For example, in an Investigation Top Values dashlet, you can edit the Result Limit from 20 to 40.
  3. Click Apply.

Some dashlets have configuration options to tailor the appearance or the contents of the dashlet. The following options are available for RE Top Alerts, RE Alert Variance, and RE Realtime Charts dashlets on left-click:

  • Hide For 24 Hours: This option allows you to hide the selected value for the next 24 hours. After 24 hours, the data will automatically be displayed on the dashlet, if the value is configured and listed on top.
  • Hide Permanently: This option allows you to hide the selected value permanently until you add it back using the Manage Hidden Values option.

    Choose an option to hide values to be displayed on the Dashlet.

  • Manage Hidden Values: This option displays a list of all the hidden values. You can select the checkbox for a value and click Remove to view the data back on the chart.

    Managing options to hide or unhide values on the dashlet.

Note: The options to Hide for 24 Hours, Hide Permanently, and Manage Hidden Values are not available for Geomap charts.

Note: When you edit a value in a preconfigured dashboard, it is a user-specific change. The changes made to a preconfigured dashboard will be applicable only to your dashboard and cannot be viewed by other users who use the same preconfigured dashboard. For example, if you hide a value in an overview dashboard, the change will be applicable only to your dashboard. If another user views the same overview dashboard, the value will still be displayed. The same applies to a custom dashboard. When you hide a value in the custom dashboard and share the same dashboard with another user, the values will still be displayed even though the dashboard is shared.

For more information on available dashlets, see the Dashboards Catalog in the RSA Content space on RSA Link.

Rearrange a Dashlet

You can arrange dashlets according to your preference by dragging and dropping them into a different order on the dashboard.

  1. To move a dashlet, hover in the header of the dashlet that you want to move.
    The directional cursor Directional cursor iconappears over the dashlet. Click and hold in the header of the dashlet that you want to move.
  2. Continue to hold the left mouse button and drag the window toward the new location.
    The figure below shows a dashlet as it is being re-arranged.
    Dashboard with dashlet moved
  3. Release the mouse button when the dashlet is in the desired location.
    The dashlet that currently occupies that position moves down.

Maximize a Single Dashlet

This section explains how to open a dashlet on the entire area of the main NetWitness Suitedashboard with the same dashlet title.  Dashlets that have a lot of columns or charts, for example some Reporting dashlets, are easier to view when maximized so that the entire contents is visible without scrolling.

To maximize a dashlet, click the maximize control icon in the dashlet title bar: maximize icon. The dashlet is displayed on full screen.

To minimize a dashlet, click the same control icon in the dashlet title bar: maximize icon. The dashlet is restored to previous size.

Dashboard showing maximized dashlet

Delete a Dashlet

  1. Click Delete icon in the dashlet title bar: 
    A confirmation pop-up is displayed to confirm if you want to delete the dashlet.
  2. Click Yes, if you want to delete. The dashlet is removed from the dashboard.
    Click No, if you do not want to delete.

Note: After you remove the dashlet, the empty space is replaced by a placeholder where you can add another dashlet using the above Add a Dashlet procedure.

Importing and Exporting Dashboards

The ability to customize dashboards to changing circumstances and conditions could result in a large number of dashboards that are not needed on a daily basis. Rather than reinvent the wheel each time you want to recreate a particular custom dashboard, you can export your dashboards that are not currently in use. When you are ready to use a previously exported dashboard, import the dashboard into NetWitness Suite.

Import a Dashboard

Note: You can import the Reporter Realtime Charts dashboard and its related charts in different instances of the NetWitness Suite server and Reporting Engine from which it was exported.

  1. In the dashboard toolbar, select Import Dashboard Import dashboard icon.
    The Import Dashboard dialog is displayed.
    Import screen to import a dashbaord to view and monitor
  2. Browse to the dashboard file in the Import Dashboard dialog. You can import .cfg and .zip files.
  3. Click Import Dashboard.
    The dashboard is displayed in NetWitness Suite

Note: If you import a dashboard from Security Analytics 10.6. x into NetWitness Suite11.0, the dashboard and the associated rules and charts must be imported separately. But when you import a dashboard from NetWitness Suite11.0 into NetWitness Suite, the dashboard and all the rules and charts associated with it, gets imported in .zip format.

Export a Dashboard

Exported dashboards are designed to work within the same NetWitness Suite instance. It is also possible to share your custom dashboards with other users in your organization, provided they have equivalent permissions.

To export a dashboard, you must have the dashboard open to access the Export Dashboard option under the Edit drop-down menu in the dashboard toolbar.

  1. Navigate to the dashboard that you want to export. All existing dashboards appear in the drop-down Dashboard Selection List in the currently displayed dashboard.
  2. Click Export Dashboard (Export dashboard icon) in the dashboard toolbar.
    The exported file is saved in the .zip format.

Note: The Export feature is not applicable for preconfigured dashboards.

Copying a Dashboard

To customize the views in NetWitness Suite, you can copy dashboards to the NetWitness dashboard or a custom dashboard. The NetWitness Suite dashboard, as the name suggests, offers all NetWitness Suite dashlets. The Copy Dashboard dialog creates a duplicate dashboard, which can be customized. When you copy a dashboard, the default name will be prefixed with Copy of. For example, if the name of the original dashboard is XYZ, the default title of the copied dashboard will be Copy of XYZ.

To copy a dashboard:

  1. Navigate to any dashboard
  2. In the dashboard toolbar, click Copy dashboard icon.
    The Copy Dashboard - Default dialog is displayed. The following screenshot is an example of copying a dashboard.
    Copy Dashboard dialog
  3. Enter the Dashboard Title.
  4. Click Copy.

Sharing a Dashboard

In NetWitness Suite, as an Administrator you can share dashboards for viewing purposes with other roles such as Administrators, Analysts, Operators and so on. When you share a dashlet, the users can only view the dashboard, make dashboard as favorite, copy the dashboard, and export the dashboard. In case of other roles such as Analysts, Operators and so on, you can share the dashboard only with similar roles. For example, an analyst will be able to share a dashboard with other analysts only.

  1. Navigate to any dashboard.
  2. In the dashboard toolbar, click Image of Share dashboard icon and select the checkbox of the role with whom you want to share the dashboard.

Note: If you do not want to share the dashboard, clear the checkbox of the role.

 

You are here

Table of Contents > Managing Dashboards

Attachments

    Outcomes