Dashboards and reports

You can build custom views of the data you want to monitor using dashboards. Create a new dashboard or use an existing dashboard as a starting point. Then, add, edit, resize, and rearrange data visualization cards to tailor the data view to you and your organization’s needs.

Navigate dashboards

The Dashboard feature consists of 5 main parts:

• Dashboards - a custom InsightIDR data view composed of data visualization cards from the Dashboard Card Library.
• Dashboard Library - pre-built dashboards that have been curated by experts at Rapid7. This library includes our compliance dashboards for ISO 27001. You can add pre-built dashboards to your dashboards list, and customize them to meet your needs.
• Card Library - pre-built data visualization cards that you can add to your custom dashboards. You can also customize pre-built cards to meet your specific use case.
• Dashboard List - the list of all the dashboards created by users in your organization. You can access it from the Dashboards and Reports page by selecting the Dashboard Management tab.
• Card Builder - the Card Builder makes it easier for users to build custom visualizations that best suit their needs

Add pre-built dashboards

1. Go to the Dashboards and Reports page.
2. Select the Dashboard Library button to access the pre-built dashboards.
3. Find the dashboard you want to add:
   • Read the dashboard descriptions to learn more about each dashboard.
   • Select Preview to view the cards for a dashboard.
   • Use the filters on the left to display the dashboards by category.
4. Select Add to immediately add to your Dashboards list. You should only add Dashboards that are applicable to you.

Create a new dashboard

1. From the InsightIDR left menu, select Dashboards and Reports.
2. From the Dashboard Management tab, select the New Dashboard button. The New Dashboard modal appears.
3. Enter a Dashboard Name and Description. The “Description” is optional, but it helps differentiate all of the dashboards at your organization.
4. Select the Create Dashboard button. As soon as you select the Create Dashboard button, the dashboard is available in the dashboard list. However, it’s empty until you add data visualization cards to it, so you’re immediately directed to the Card Library. From there, you can find, add, and customize cards for your dashboard. Read Dashboard Cards to learn all about customizing the data visualization cards on your dashboard. If you can’t find a card you want in the Card Library, build your own in the Card Builder.

Edit an existing dashboard

You can edit, remove, resize, reposition, and add new cards on any dashboard, including pre-built dashboards. Just open the dashboard and make your changes. They are saved automatically.

Edit the dashboard name or description

To edit the name or description associated with the dashboard, you can do so from the dashboard list or an open dashboard. Select the gear icon, select Edit Dashboard, then make and save your changes.

Edit dashboard details

1. From the dashboards list, open the dashboard you want to edit.
2. To adjust the data refresh rate of your dashboard, select a new value from the refresh rate dropdown list.
3. To edit the cards, select the gear icon on the card you want to edit, select Edit, and make and save your changes.

Copy a dashboard

You may want to use an existing dashboard as a starting point for a new dashboard to save you time. If so, select the gear icon and select Copy Dashboard, then edit the copy as needed.

Dashboard cards

Dashboard cards contain visualizations of your data. Without cards, your dashboard is just a blank screen. When you add cards to a dashboard, you’re adding the data you want to see in that particular view. Dashboard cards live in the Card Library. The Card Library contains the pre-built data visualization cards you use to create dashboards. You can preview real data in the card before adding it to your dashboard.

To access the library, select the Card Library button from an open dashboard. You can then search for cards using the search bar, or browse for cards by category. From the Card Library you can find Rapid7-created cards, add them to your dashboard, and customize them to fit your needs. In each card you can choose to use a LEQL query or pre-computed query.

Customize a pre-built card

You can add a pre-built card to your dashboard and customize the name, description, and data it displays.

To add and customize pre-built cards:

1. Open an existing dashboard or create a new one.
2. Select the Card Library.
3. Choose the card you'd like to add to your dashboard.
4. Select Add to add the card to your dashboard.
   • Optionally, select Preview > Edit to change the name and description of the card, then select Add to add the card to your dashboard.
5. Click the gear icon on the card you want to edit then select Edit.
6. Update the card name and description at the top of the modal.
7. In the Data tab, choose the Type of query.
   For LEQL queries:

   1. Enter a Series Name.
   2. Optionally, select a Saved Query.
   3. Set a time range in the For the Period field.
   4. Select a log set or log sets to query in your card.
   5. If you're not using a saved query, enter the Full Query.
   For pre-computed queries:

   1. Enter a Series Name.
   2. Pick your query.
   3. Set a time range in the For the Period field.
8. In the Chart tab, choose the Chart Type.
9. The remaining options in the Chart tab will vary based on the chart type. Update any fields you choose to customize your card.

Build a custom card

You can build a custom card that is specific to your requirements.

To build a custom card:

1. Open an existing dashboard or create a new one.
2. Select Create Card.
3. Enter a name and description for the card at the top of the modal.
4. Choose the Type of query.
   For LEQL queries:

   1. Enter a Series Name.
   2. Optionally, select a Saved Query.
   3. Set a time range in the For the Period field.
   4. Select a log set or log sets to query in your card.
   5. If you're not using a saved query, enter the Full Query.
   For pre-computed queries:

   1. Enter a Series Name.
   2. Pick your query.
   3. Set a time range in the For the Period field.
5. Optionally choose to Add Another Data Source and repeat the necessary steps.
6. Select Next.
7. In the Chart tab, choose the Chart Type.
8. The remaining options in the Chart tab will vary based on the chart type. Update any fields you choose to customize your card.

Pre-computed queries

Pre-computed queries are best suited for cards when your queries span a large time range, you're querying a large amount of data, you routinely search with the same LEQL statement, or if your searches typically take a long time to return results.

Customize a card with pre-computed queries:

1. Select a dashboard > click + Create Card.
2. Enter a name and description for your dashboard card.
3. Set the query toggle to Pre-Computed Query.
4. Click Select a query and choose the pre-computed query you want to add to your dashboard card.
5. Fill in the remaining fields.
6. Click Next.
7. Click Save.

Add pre-computed queries to existing cards:

1. Choose a card to add a pre-computed query to.
2. Select the gear icon on your card > click Edit.
3. Set the query toggle to Pre-Computed Query.
4. Click Select a query and choose the pre-computed query you want to add to your dashboard card.
5. Click Save Changes.

By default, any card that a pre-computed query is added to will populate with data from the 30 days before the creation of your pre-computed query. If you make any edits to the pre-computed query, the data displayed in the card will be based on the 30 days before any changes are made.

It may take some time for the entirety of the data to be visible in your card due to the amount of data that needs to be processed and the specified time frame.

View dashboards

Select the All Dashboards button to access a list of dashboards created by users in your organization. You can then open and view any dashboard in the list by clicking the dashboard name.

Filter dashboards

Dashboard filtering gives you another level of flexibility to find the insights you want. By default, no filter is applied to your dashboard.

To apply a filter:

• At the top of your dashboard, select the filter icon.
• Select Edit and either select a saved query from Log Search or type a valid query. As you type, syntax highlighting displays the different syntax elements in contrasting colors to help you build a query.
• Select Apply. This filter will be applied to all cards on your dashboard.
• Select Save to either save the filtered view to your current dashboard or use the filter to create a new dashboard.

You can also create reports from your filtered views by clicking Create Report.

Filter examples

To filter your dashboard to focus on a specific asset or user, you could create the query “asset=ExampleCollector”. Then, select "Apply" to filter your dashboard. How you can leverage dashboard filters:

• Create a network perimeter-themed dashboard and then use dashboard filters to focus on a specific IP address or asset.
• Build a cloud-focused dashboard and then use dashboard filters to focus on activity associated with a single EC2 instance
• Create a network activity dashboard and then use a domain filter like “dropbox” to focus on any Dropbox activity on a network

Manage dashboards

As the number of dashboards you generate increases, you might need to tag and organize them. From the Dashboard Management tab, you can:

• Set favorites to keep track of your most important dashboards.
• Easily filter the list of dashboards by favorites, owner, or tags.
• Manage and assign tags to dashboards.
• Delete multiple dashboards at once.
• Reassign dashboards to new owners.

Manage reports

You can easily create, schedule, and send reports to anyone you want. You can also access streamlined report management tools on the Report Management tab.

Create and schedule a report

You can create a report either from within a dashboard or from the Report Management tab.

After a report is created, you can:

• Download or share the report to others in your organization within an email as a PDF, HTML, or CSV file.
• Set the report to be sent on a specified schedule.

Create and schedule reports from a dashboard

1. From the InsightIDR left menu, select Dashboards and Reports.
2. Select the dashboard that you want to report on.
3. Select the Create Report dropdown.

4. Choose From Dashboard to generate a static dashboard report, or Custom From Dashboard to have the ability to modify it in the report builder.
   • From Dashboard creates a report linked to the dashboard.
     • Any future changes made to the dashboard will be reflected in the report.
   • Custom From Dashboard creates a new report that can be customized and will not be linked to the dashboard.
     • Any changes to the report will need to be made directly in the report from the Report Management tab.
     • Customize your report by adding cards from the Card Library or from your dashboards, editing section names and descriptions, and adjusting the layout with move and resize options.
5. Enter a report name and description.
6. Select your desired report format. You can select PDF, HTML, CSV or all three.
7. Optionally, if creating From Dashboard, choose if you'd like the report to use saved dashboard filters.
8. Select Add Schedule to generate and share your report on a specified schedule.
9. Select Create Report to save your changes.

Create and schedule reports from the Report Management tab

1. From the InsightIDR left menu, select Dashboards and Reports.
2. Navigate to the Reports tab.
3. Select the Create Report dropdown.
4. Select one of these options:
   • New - Start from a blank report.
   • From Dashboard - Use a pre-existing dashboard as a template.
   • From Template - Browse the Report Library for a template to suit your needs.
5. Customize your report by adding cards from the Card Library or from your dashboards, editing section names and descriptions, and adjusting the layout with move and resize options.
6. Choose the report format. You can select PDF, HTML, CSV or all three.
7. Optionally, in the Scheduling tab, select Add Schedule to generate and share your report on a specified schedule.
8. Click Create Report to save and generate your customized report.

As the number of reports you generate increases, you might need to tag and organize them. From the Report Management tab, you can:

• Set favorites to keep track of your most important reports and schedules.
• Easily filter the list of reports by favorites, owner, tag, or the date the report was generated.
• Manage and assign tags to reports.
• Delete multiple reports at once.
• Reassign reports to new owners.