Add and Manage Cards

We are rolling out NEW dashboards and reports starting June 2021

This article explains how to add and manage cards using our legacy Dashboards, which will be deprecated after we migrate everyone to the new experience. For more information about our new dashboards and reports, see Dashboards and Reports.

After you create a dashboard, you can begin adding cards to it. Simply go to a dashboard and press the Add a Card button. Select to add a preconfigured card from the card library, or build your own card using a query.

Add a Card from the Library

Preconfigured cards are sorted into categories from your available logs.

When you select the category label, it will display all visual options available to you.

Preconfigured Cards

The following table lists all of the preconfigured cards available to you from InsightIDR:

Name	Type	Description
1.3.5 Denied Connection Attempts	Compliance	Visualize denied connections attempts as specified in PCI control 1.3.5
10.2.4 Failed Logins Over Time	Compliance	Visualize the number of failed logins over time per PCI control 10.2.4
10.2.5a Authentications Over Time	Compliance	Visualize all asset authentication over time per PCI control 10.2.5a
4.1c Potential Insecure Connections	Compliance	Visualize connections that appear to be insecure (over port 80) as specified in PCI control 4.1c
7.1.2b User authentications	Compliance	List of users who have logged in, in the specified time period per PCI control 7.1.2b
8.1.1 Shared/Linked Accounts	Compliance	List of shared/linked accounts used in the specified time period per PCI control 8.1.1
8.1.3a Deactivated Accounts	Compliance	List of deactivated accounts in the last 6 months per PCI control 8.1.3a
8.2.4a Recent Password Resets	Compliance	List of users who have had passwords reset within the specified time period per PCI control 8.2.4a
AD Admin Actions	Active Directory Admin Activity	Show all "admin actions"
Account Lockouts over Time	Active Directory Admin Activity	Shows the number of account lockouts by day
Accounts Created	Active Directory Admin Activity	Users accounts that have been created
Accounts Disabled	Active Directory Admin Activity	User accounts that have been disabled
Accounts Locked	Active Directory Admin Activity	User accounts that have been locked
Groups Users Were Added To	Active Directory Admin Activity	Groups that had users added to them
Passwords Set to Never Expire	Active Directory Admin Activity	User accounts where the password was set to never expire
Users Added to Groups	Active Directory Admin Activity	Accounts that were added to groups
Users Who Added to Groups	Active Directory Admin Activity	Accounts that added users to groups
Assets Accessing Excel & Word Files	File Access Activity	See which assets in your organization are being used to access the most text files and/or spreadsheets.
DNS Queries to Uncommon Domains By Asset	DNS Query	Quickly see which assets are making requests to domains with uncommon public suffixes. This may help you determine if a specific asset is making unwanted requests to strange domains (possibly an indicator of malware).
DNS Queries to Uncommon Domains by Public Suffix	DNS Query	Visualize request volume to domains that use an uncommon suffix.
DNS Queries to Uncommon Domains by User	DNS Query	Quickly see which users are making requests to domains with uncommon public suffixes. This may help you determine if a user is making unwanted requests to strange domains.
DNS Queries to Uncommon Domains over Time	DNS Query	Visualize traffic to uncommon domains over time. This may help you see patterns, trends or anomalies in your organizations internet activity.
Total DNS Traffic over time	DNS Query	Visualize your organization's total DNS traffic over time. This may help you see patterns, trends or anomalies.
Denied Traffic by port	Firewall Activity	Quickly visualize which destination ports have the most firewall denies.
Denied Traffic over time	Firewall Activity	Visualize the volume of firewall denies over time. This may help you see patterns, trends or anomalies in denied network traffic.
Inbound & Outbound traffic from Non-US countries by User	Firewall Activity	Track international traffic volume by user over time. This may help you see patterns, trends or anomalies in user activity.
Inbound & Outbound traffic to Non-US countries by country	Firewall Activity	Track international traffic volume by country over time. This may help you see patterns, trends or anomalies in total international network traffic.
Inbound Traffic from a Non-US Country by Port	Firewall Activity	Track international traffic volume by destination port over time. This may help you see patterns, trends or anomalies in application-specific traffic.
Traffic to or from a Non-US country	Firewall Activity	Visualize the volume of all international network traffic by country.
Traffic to or from a Non-US country ordered by User	Firewall Activity	Quickly see which users are generating the most international network traffic.
Disabled Users Authenticating	Asset Authentication	Quickly see authentication attempts to disabled users. This may help you determine if there is a misconfiguration in your organization, or show you an indicator of brute force attempts against a specific disabled user.
Failed Authentications - Users	Asset Authentication	Show all failed authentication activity by user
Failed Authentications by Type	Asset Authentication	Show all failed authentication activity by type
Failed Logins by Destination Asset	Asset Authentication	Quickly see which assets have the most failed authentications. This may be a misconfiguration or an indicator of a brute force attack on a specific asset.
Failed Logins by User	Asset Authentication	Quickly see which users have the most failed authentications.
Failed Logins over time	Asset Authentication	Track failed authentications over time. This may help you see patterns, trends or anomalies in overall failed authentications within your organization.
First Time Authentication from Unfamiliar Source Asset	Asset Authentication	Shows users who have logged into an asset from an unfamiliar source asset
First Time Authentications by User	Asset Authentication	Shows the number of first time authentications, sorted by user
Interactive Authentications by System	Asset Authentication	Show which systems users have logged into interactively or remotely (remote here means via Remote Desktop)
Local Administrator Network Logon Activity	Asset Authentication	Visualize local administrator authentications by asset.
Login Count by Type	Asset Authentication	Quickly see the number of successful authentications by asset type.
Logon Types	Asset Authentication	Show all the different types of authentication
File Access by Name & Extension	File Access Activity	Quickly see the most accessed files in your network by filename and extension.
File Access over time	File Access Activity	Visualize your organization's total file access activity over time. This may help you see patterns, trends or anomalies.
File Share Access by Source Asset	File Access Activity	Quickly see which assets connect to your organization's file shares most often.
File Share Access by User	File Access Activity	Quickly see which users access your organization's file shares most often.
Users Accessing Excel & Word Files	File Access Activity	See which users in your organization are accessing the most text files and/or spreadsheets.
High Severity IDS Alerts	IDS Alert	The number of high severity IDS alerts that have fired
Medium Severity IDS Alerts	IDS Alert	The number of medium severity IDS alerts that have fired
Low Severity IDS Alerts	IDS Alert	The number of low severity IDS alerts that have fired
IDS Alert by Rule	IDS Alert	Breakdown your IDS alerts by rule
IDS Alerts by Country	IDS Alert	Quickly see which countries are associated with IDS alerts in your environment
IDS Alerts by User	IDS Alert	Visualize which users have IDS alerts attributed to them
IDS Alerts for Unknown User by Source IP	IDS Alert	Visualize your IDS alerts which did not have a known User attributed to them
IDS alerts by Asset	IDS Alert	Breakdown your IDS alerts by Asset
IDS alerts for unknown Assets by IP	IDS Alert	Visualize your IDS alerts which did not have a known Asset attributed to them
Ingress Authentications by ISP	Ingress Authentication	Breakdown ingress activity by which Service Provider the activity is originating from
Ingress Authentications by Location	Ingress Authentication	See where in the world your users are connecting to your network from
Ingress Authentications by Service	Ingress Authentication	Visualize ingress into your network by the cloud service it originated from
Ingress Authentications from China	Ingress Authentication	Quickly see which users are ingressing into your network from China
Ingress Authentications from Russia	Ingress Authentication	Quickly see which users are ingressing into your network from Russia
Ingress Authentications from outside the US by user	Ingress Authentication	Quickly see which users are ingressing into your network from outside the United States
Ingress Authentications over the last 24 hours	Ingress Authentication	Visualize trends in ingress activity over 24 hours
Ingress Authentications over the last 24 hours from Outside the US	Ingress Authentication	Visualize international ingress activity over 24 hours
Virus Alerts Over Last 24 Hours	Virus Alert	Visualize AV trends over time
Virus Alerts by Asset	Virus Alert	See which assets in your network are potentially infected
Virus Alerts by File	Virus Alert	Breakdown the virus alerts in your network by the files being alerted upon
Virus Alerts by User	Virus Alert	Quickly see which users have the most AV activity associated with them

Build Your Own Card

If you decide to build your own visual card, you need to provide a query and select the log(s) you want to apply the query to. Learn how to Build a Query or use Example Queries when building your own card.

After selecting an option, you will see a live preview of the results of your query. Visualizations that are not compatible with your query are greyed out.