Introduction
This is a document about Logsign Unified SecOps Platform, which provides a library of predefined dashboard panels in 12 different categories and 28 different widget types for building them. Additionally, custom dashboard panels can be defined for monitoring any number of systems.
This document covers information about "Predefined Alarm Dashboard Panels" and "Data Insights and Visualizations with High Probability Events (Incidents)."
Predefined Alarm Dashboard Panels
On the Dashboards page, click the menu icon in the upper left corner to list the dashboard panels by category.
Under the Alert category, four different predefined dashboard panels are listed:
- Alert Rules Overview
- Warning/Information Level Alert Analysis
- Action Object & Alert Overview
- Critical/Emergency Level Alert Analysis
Alarm detail analyses can be examined in the four predefined dashboard panels mentioned above.
Creating a Dashboard Panel for High Probability Events (Incidents)
Logsign continuously monitors the system with predefined Entity and Behavior Lists. Therefore, the analysis of an abnormal event can be provided with the enrichment of the data. Based on an IP, User, or Entity's previous entry into a Behavior List, it can be labeled as Suspicious, Attacker, or Victim in the Context fields.
With the widgets and dashboard panels provided by the Logsign Unified SecOps Platform, this information can be visualized and analyzed quickly.
In the example below, an IP labeled as "Suspicious" will be analyzed for "Why it was labeled as suspicious" and "Which list it entered, when it entered," and a "Dashboard Panel" will be created for tracking this data for different IPs, Users, or Entities.
Go to the "Search" page on the Logsign Unified SecOps Platform and use "Context.SourceIP:Suspicious" as the query.
Filter the IP you want to analyze using the Filters panel, and the results are listed for the selected IP.
Let's take the "107.150.126.151" IP as an example.
The filtered logs can be narrowed down further from the Filters panel, and details can be viewed on the listed logs.
Additionally, a "Dashboard Panel" can be created to track this and similar data for different IPs, Users, or Entities.
Go to the "Dashboards" page, click the "New Dashboard" button, and enter the Name and Category of the dashboard panel. You can also set Tags and Roles in the same form.
Click "Add New Widget", select the desired widget type (you can filter the list with the "Search widgets..." box), and enter the query as "Context.SourceIP:Suspicious" as mentioned in the example above.
Examples can be replicated with different widgets to enrich the dashboard panel.