Dashboards and Reports

You can build custom views of the data you want to monitor using dashboards. Create a new dashboard or use an existing dashboard as a starting point. Then, add, edit, resize, and rearrange data visualization cards to tailor the data view to you and your organization’s needs.

The Dashboard feature consists of 5 main parts:

  • Dashboards - a custom InsightIDR data view composed of data visualization cards from the Dashboard Card Library.
  • Dashboard Library - pre-built dashboards that have been curated by experts at Rapid7. This library includes our compliance dashboards for ISO 27001. You can add pre-built dashboards to your dashboards list, and customize them to meet your needs.
  • Card Library - pre-built data visualization cards that you can add to your custom dashboards. You can also customize pre-built cards to meet your specific use case.
  • Dashboard List - the list of all the dashboards created by users in your organization. You can access it from the Dashboards and Reports page by selecting the All Dashboards tab.
  • Card Builder - the Card Builder makes it easier for users to build custom visualizations that best suit their needs

Add Pre-built Dashboards

  1. Go to the Dashboards and Reports page.
  2. Select the Dashboard Library button to access the pre-built dashboards.
  3. Find the dashboard you want to add:
    • Read the dashboard descriptions to learn more about each dashboard.
    • Select Preview to view the cards for a dashboard.
    • Use the filters on the left to display the dashboards by category.
  4. Select Add to immediately add to your Dashboards list. You should only add Dashboards that are applicable to you.

Customize your Pre-Built Dashboard

Once the Dashboard has been added, it is fully customizable. You can edit the dashboard details or add, create and delete cards to ensure your Dashboard meets your requirements.

Create a New Dashboard

  1. From the InsightIDR left menu, select Dashboards and Reports.
  2. From the dashboard list, select the New Dashboard button. The New Dashboard modal appears.
  3. Enter a Dashboard Name and Description. The “Description” is optional, but it helps differentiate all of the dashboards at your organization.
  4. Select the Create Dashboard button. As soon as you select the Create Dashboard button, the dashboard is available in the dashboard list. However, it’s empty until you add data visualization cards to it, so you’re immediately directed to the Card Library. From there, you can find, add, and customize cards for your dashboard. Read Dashboard Cards to learn all about customizing the data visualization cards on your dashboard. If you can’t find a card you want in the Card Library, build your own in the Card Builder.

Edit an Existing Dashboard

You can edit, remove, resize, reposition, and add new cards on any dashboard, including pre-built dashboards. Just open the dashboard and make your changes. They are saved automatically.

Edit the dashboard name or description

To edit the name or description associated with the dashboard, you can do so from the dashboard list or an open dashboard. Select the gear icon, select Edit Dashboard, then make and save your changes.

Edit dashboard details

  1. From the dashboards list, open the dashboard you want to edit.
  2. To adjust the data refresh rate of your dashboard, select a new value from the refresh rate dropdown list.
  3. To edit the cards, select the gear icon on the card you want to edit, select Edit, and make and save your changes.

Copy a dashboard

You may want to use an existing dashboard as a starting point for a new dashboard to save you time. If so, select the gear icon and select Copy Dashboard, then edit the copy as needed.

Dashboard Cards

Dashboard cards contain visualizations of your data. Without cards, your dashboard is just a blank screen. When you add cards to a dashboard, you’re adding the data you want to see in that particular view. Dashboard cards live in the Card Library. The Card Library contains the pre-built data visualization cards you use to create dashboards. You can preview real data in the card before adding it to your dashboard.

To access the library, select the Card Library button from an open dashboard. You can then search for cards using the search bar, or browse for cards by category. From the Card Library you can search for Rapid7-created cards, add them to your dashboard, and customize them to fit your needs. In each card you can choose to use a LEQL query or pre-computed query.

Pre-computed queries are best suited for cards that span over a large time range or query a large amount of data. Pre-computed queries run against the selected log set upon ingestion and the point-in-time result is stored in the card. Whenever the query runs again, any new event data is added to the previously stored results. Because of this behavior, a card that uses a pre-computed query will load quicker than a card using a LEQL query.

Customize a pre-built card

You can add a pre-built card to your dashboard and customize the name, description, and data it displays.

To add and customize pre-built cards:

  1. Open an existing dashboard or create a new one.
  2. Select the Card Library.
  3. Choose the card you'd like to add to your dashboard.
  4. Select Add to add the card to your dashboard.
    • Optionally, select Preview > Edit to change the name and description of the card, then select Add to add the card to your dashboard.
  5. Click the gear icon on the card you want to edit then select Edit.
  6. Update the card name and description at the top of the modal.
  7. In the Data tab, choose the Type of query.
    For LEQL queries:
    1. Enter a Series Name.
    2. Optionally Select a Saved Query.
    3. Set a time range in the For the Period field.
    4. Select a log set or log sets to query in your card.
    5. If you're not using a saved query, enter the Full Query.
    For pre-computed queries:
    1. Enter a Series Name.
    2. Pick your query.
    3. Set a time range in the For the Period field.
  8. In the Chart tab, choose the Chart Type.
  9. The remaining options in the Chart tab will vary based on the chart type. Update any fields you choose to customize your card.

Visualize card data in layers

To visualize your card data in layers, open the Edit modal and group by up to five fields in your full query.

Build a Custom Card

You can build a custom card that is specific to your requirements.

To build a custom card:

  1. Open an existing dashboard or create a new one.
  2. Select Create Card.
  3. Enter a name a description for the card at the top of the modal.
  4. Choose the Type of query.
    For LEQL queries:
    1. Enter a Series Name.
    2. Optionally Select a Saved Query.
    3. Set a time range in the For the Period field.
    4. Select a log set or log sets to query in your card.
    5. If you're not using a saved query, enter the Full Query.
    For pre-computed queries:
    1. Enter a Series Name.
    2. Pick your query.
    3. Set a time range in the For the Period field.
  5. Optionally choose to Add Another Data Source and repeat the necessary steps.
  6. Select Next.
  7. In the Chart tab, choose the Chart Type.
  8. The remaining options in the Chart tab will vary based on the chart type. Update any fields you choose to customize your card.

View Dashboards

Select the All Dashboards button to access a list of dashboards created by users in your organization. You can then open and view any dashboard in the list by clicking the dashboard name.

Filter Dashboards

Dashboard filtering gives you another level of flexibility to find the insights you want. By default, no filter is applied to your dashboard.

To apply a filter:

  • At the top of your dashboard, select the filter icon.
  • Select Edit and either select a saved query from Log Search or a type a valid query. As you type, syntax highlighting helps you build a query by displaying the different syntax elements in contrasting colors.
  • Select Apply. This filter will be applied to all cards on your dashboard.
  • Select Save to either save the filtered view to your current dashboard or use the filter to create a new dashboard.

Cards using precomputed queries are not compatible with dashboard filters

Rewrite any precomputed queries as LEQL queries to apply the dashboard filter. Loading times for cards using LEQL queries may be slower.

You can also create reports from your filtered views by clicking Create Report.

Filter Examples

To filter your dashboard to focus on a specific asset or user, you could create the query “asset=ExampleCollector”. Then, select "Apply" to filter your dashboard. How you can leverage dashboard filters:

  • Create a network perimeter-themed dashboard and then use dashboard filters to focus on a specific IP address or asset.
  • Build a cloud-focused dashboard and then use dashboard filters to focus on activity associated with a single EC2 instance
  • Create a network activity dashboard and then use a domain filter like “dropbox” to focus on any Dropbox activity on a network

Manage Reports

You can easily create, schedule, and send reports based on their dashboards to anyone you want. To access your reports, go to Dashboards and Reporting and select the Reports tab.

Reports tab

Create and Schedule a Report

  1. From the InsightIDR left menu, select Dashboards and Reports.
  2. Select the dashboard that you want to report on.
  3. Select Create Report.

Create a report from your dashboard

  1. Enter a report name and description.
  2. Select your desired report format. You can select PDF, HTML, or both.
  3. Optionally, choose if you'd like the report to use saved dashboard filters.
  4. Select Add Schedule to generate and share your report on a specified schedule.
  5. Select Create Report to save your changes.

Report Details