Dashboards and Reports

You can build custom views of the data you want to monitor using dashboards. Create a new dashboard or use an existing dashboard as a starting point. Then, add, edit, resize, and rearrange data visualization cards to tailor the data view to you and your organization’s needs.

Navigate Dashboards

The Dashboard feature consists of 5 main parts:

• Dashboards - a custom InsightIDR data view composed of data visualization cards from the Dashboard Card Library.
• Dashboard Library - pre-built dashboards that have been curated by experts at Rapid7. This library includes our compliance dashboards for ISO 27001. You can add pre-built dashboards to your dashboards list, and customize them to meet your needs.
• Card Library - pre-built data visualization cards that you can add to your custom dashboards. You can also customize pre-built cards to meet your specific use case.
• Dashboard List - the list of all the dashboards created by users in your organization. You can access it from the Dashboards and Reports page by selecting the All Dashboards tab.
• Card Builder - the Card Builder makes it easier for users to build custom visualizations that best suit their needs

Add Pre-built Dashboards

1. Go to the Dashboards and Reports page.
2. Select the Dashboard Library button to access the pre-built dashboards.
3. Find the dashboard you want to add:
   • Read the dashboard descriptions to learn more about each dashboard.
   • Select Preview to view the cards for a dashboard.
   • Use the filters on the left to display the dashboards by category.
4. Select Add to immediately add to your Dashboards list. You should only add Dashboards that are applicable to you.

Create a New Dashboard

1. From the InsightIDR left menu, select Dashboards and Reports.
2. From the dashboard list, select the New Dashboard button. The New Dashboard modal appears.
3. Enter a Dashboard Name and Description. The “Description” is optional, but it helps differentiate all of the dashboards at your organization.
4. Select the Create Dashboard button. As soon as you select the Create Dashboard button, the dashboard is available in the dashboard list. However, it’s empty until you add data visualization cards to it, so you’re immediately directed to the Card Library. From there, you can find, add, and customize cards for your dashboard. Read Dashboard Cards to learn all about customizing the data visualization cards on your dashboard. If you can’t find a card you want in the Card Library, build your own in the Card Builder.

Edit an Existing Dashboard

You can edit, remove, resize, reposition, and add new cards on any dashboard, including pre-built dashboards. Just open the dashboard and make your changes. They are saved automatically.

Edit the dashboard name or description

To edit the name or description associated with the dashboard, you can do so from the dashboard list or an open dashboard. Select the gear icon, select Edit Dashboard, then make and save your changes.

Edit dashboard details

1. From the dashboards list, open the dashboard you want to edit.
2. To adjust the data refresh rate of your dashboard, select a new value from the refresh rate dropdown list.
3. To edit the cards, select the gear icon on the card you want to edit, select Edit, and make and save your changes.

Copy a dashboard

You may want to use an existing dashboard as a starting point for a new dashboard to save you time. If so, select the gear icon and select Copy Dashboard, then edit the copy as needed.

Dashboard Cards

Dashboard cards contain pre-built visualizations of your data. Without cards, your dashboard is just a blank screen. When you add cards to a dashboard, you’re adding the data you want to see in that particular view. Dashboard cards live in the Card Library.

From the Card Library you can:

• Find Cards
• Add Cards to Your Dashboard
• Customize Pre-Built Cards

In each card you can choose to use a:

• LEQL query
• Precomputed query

Precomputed queries are best suited for cards that span over a large time range or query a large amount of data. Precomputed queries run against the selected log set upon ingestion and the point-in-time result is stored in the card. Whenever the query runs again, any new event data is added to the previously stored results. Because of this behavior, a card that uses a precomputed query will load quicker than a card using a LEQL query.

Find Cards

The Dashboard Card Library contains the pre-built data visualization cards you use to create dashboards. You can preview real data in the card before adding it to their dashboard. To access the library, select the Add Card button from an open dashboard. You can then search for cards using the search bar, or browse for cards by category.

Add Cards to Your Dashboard

In InsightIDR it is possible to save yourself some time by adding cards curated by Rapid7 experts to your dashboards. To add card(s) to dashboard:

• Select your dashboard and select the Add Card button.
• View the Card Library and select Add on desired cards.
• Return to your dashboard to view your cards.

Customize Pre-Built Cards

You can customize the name and description of pre-built cards before and after you add them to your dashboard.

To customize pre-built cards before adding them to your dashboard:

1. Open your dashboard and select Add Card.
2. In the Card Library, find the card that you'd like to use and select Preview.
3. Select Edit to update the card's name and description.
4. Select Add.

To customize pre-built cards after adding them to your dashboard:

1. Click the gear icon on the card you want to edit then select Edit.
2. In the Name Card section, update the Card Name and Card Description.
3. In the Select Data Source section, choose to use a LEQL query or select a precomputed query.

For LEQL queries:

• Enter a Display Name.
• Optionally Select a Saved Query.
• Set a time range.
• Select a log set or log sets to query in your card.
• If you're not using a saved query, enter the Full Query.

For precomputed queries:

• Enter a Display Name.
• Pick your query.
• Set a time range.

4. The options in the Configure Chart section will vary based on the chart type you select in the Switch Charts section. Update any fields you choose to customize your card.

Build a Custom Card

You can build a custom card that is specific to your requirements.

To build a custom card:

• Open your dashboard and select Add Card.
• Select Create Card and enter the card details.
• In the Select Data Source section, you can enter a LEQL query, select a saved query from Log Search, or select a precomputed query. As you type, syntax highlighting helps you build a query by displaying the different syntax elements in contrasting colors.
• Select Add to Dashboard.

View Dashboards

Select the All Dashboards button to access a list of dashboards created by users in your organization. You can then open and view any dashboard in the list by clicking the dashboard name.

Filter Dashboards

Dashboard filtering gives you another level of flexibility to find the insights you want. By default, no filter is applied to your dashboard.

To apply a filter:

• At the top of your dashboard, select the filter icon.
• Select Edit and either select a saved query from Log Search or a type a valid query. As you type, syntax highlighting helps you build a query by displaying the different syntax elements in contrasting colors.
• Select Apply. This filter will be applied to all cards on your dashboard.
• Select Save to either save the filtered view to your current dashboard or use the filter to create a new dashboard.

You can also create reports from your filtered views by clicking Create Report.

Filter Examples

To filter your dashboard to focus on a specific asset or user, you could create the query “asset=ExampleCollector”. Then, select "Apply" to filter your dashboard. How you can leverage dashboard filters:

• Create a network perimeter-themed dashboard and then use dashboard filters to focus on a specific IP address or asset.
• Build a cloud-focused dashboard and then use dashboard filters to focus on activity associated with a single EC2 instance
• Create a network activity dashboard and then use a domain filter like “dropbox” to focus on any Dropbox activity on a network

Manage Reports

You can easily create, schedule, and send reports based on their dashboards to anyone you want. To access your reports, go to Dashboards and Reporting and select the Reports tab.

Create and Schedule a Report

1. From the InsightIDR left menu, select Dashboards and Reports.
2. Select the dashboard that you want to report on.
3. Select Create Report.

4. Enter a report name and description.
5. Select your desired report format. You can select PDF, HTML, or both.
6. Optionally, choose if you'd like the report to use saved dashboard filters.
7. Select Add Schedule to generate and share your report on a specified schedule.
8. Select Create Report to save your changes.