Managing Dashboards

Managing Dashboards

A dashboard is a group of dashlets that give you the ability to view data in one space, the key snapshots of the various components that you consider important. In NetWitness, you can compose dashboards to obtain high-level information and metrics that portray the overall picture of a NetWitness deployment, displaying only the information that is most relevant to the day-to-day operations.

The dashboards for all NetWitness components are available to add to the default NetWitness dashboard or a custom NetWitness dashboard.

You can view dashboards on different areas of interest depending on your user permissions. You have the option to select a preconfigured dashboard, import a dashboard, or create your own custom dashboard. The dashboards help you to quickly and easily view reports. You can configure your dashboards to display the information that supports your workflow. This topic explains the high-level tasks that can be done when you are setting up a dashboard.

Dashboard Basics

If the Dashboard view is your default landing page following logging in to NetWitness, you always see either the default dashboard or the currently configured dashboard immediately after completing the login process. To return to the dashboard from another NetWitness component, click Dashboard.

Dashboard Title

The dashboard title reflects the currently active dashboard; for example, Default Dashboard.

Dashboard Selection List

You can access preconfigured and custom dashboards on the dashboard selection list. When you select a dashboard, its title is displayed below the NetWitness toolbar.

A dashboard has:

• The dashboard toolbar
• The dashboard title and the dashboard selection list.

Dashboard Toolbar

The dashboard toolbar is available next to the title of the selected dashboard. The dashboard toolbar allows various operations on dashboards and dashlets.

Note: The Copy, Delete, Import, Export, Share, and Add Row options are disabled for preconfigured dashboards.

The Default Dashboard

The default dashboard is configured to display specific dashlets in specific positions. The default dashboard serves as an example of dashboard composition and a starting point for customization.

• You can customize the information on the default dashboard by editing, adding, moving, maximizing, and deleting dashlets.
• After modifying the default dashboard, you can restore the default dashboard () to its original layout.
• The default dashboard cannot be deleted or shared.

Selecting a Preconfigured Dashboard

On installation of NetWitness, the following preconfigured dashboards are automatically activated and are available to you:

• Default
• Identity
• Investigation
• Operations - File
• Operations - Logs
• Operations - Network
• Operations - Protocol Analysis
• Overview
• SecurID
• Threat - Hunting
• Threat - Intrusion
• Threat - Malware Indicators

You cannot perform the following actions on a preconfigured dashboard:

• Edit a dashboard
• Export a dashboard
• Share a dashboard
• Delete a dashboard

For more information on each preconfigured dashboard, see the Dashboards Catalog in the NetWitness Content space on NetWitness Community.

Note: If you are logged into an Analyst UI, you can view but cannot enable, disable, or edit preconfigured Dashboards.

Enabling or Disabling Dashboards

When you enable or disable a dashboard, all the dashlets within the dashboard are enabled or disabled along with the associated charts, unless they are used in any other dashboard.

NetWitness modules can display only those dashlets presented in the Manage Dashboard dialog. The main dashboard offers all NetWitness dashlets. This is an example of currently available dashlets.

Enable a Dashboard

If you select a dashboard that is not enabled, a masked screen is displayed.

To enable one or more dashboards:

1. Navigate to the dashboard to be enabled.

2. In the dashboard toolbar, click (Manage Dashboards).
   The Manage Dashboards dialog is displayed.
   

3. From the dashboard list, select the dashboards to be enabled.

4. Select the Enable checkbox.

5. Click Save.

Disable a DashboardDisable a Dashboard

To disable one or more dashboards:

1. Navigate to the dashboard to be disabled.

2. In the dashboard toolbar, click (Manage Dashboards).
   The Manage Dashboards dialog is displayed.
   

3. From the dashboard list, select the dashboards to be disabled.

4. Select the Disable checkbox.
5. Click Save.

Setting a Dashboard as a Favorite

To customize the views in NetWitness, you can set a preconfigured or custom dashboard as a Favorite. The NetWitness dashboard offers all NetWitness dashlets. The Favorite dialog sets a specific dashboard as your favorite dashboard and is listed as favorite every time you log in to NetWitness.

1. Navigate to any dashboard.

2. In the dashboard toolbar, click

   If the favorite icon is red in color, it indicates that selected dashboard is set as a Favorite and is listed on top above the line.

Creating Custom Dashboards

You can create custom dashboards to serve a particular purpose; for example, to represent a specific geographical or functional area of the network. Each custom dashboard is appended to the dashboard selection list.

To create a custom dashboard:

1. In the dashboard toolbar, click .
   The Create a Dashboard dialog is displayed.
   
2. Enter a title for the new dashboard and click Create.
   The new dashboard is displayed as a blank screen.
   
3. Add rows to the dashboard, which can contain one or more columns, using the Add Row option on the right side of the screen (). Click the desired column configuration in the drop-down list to add one row to the dashboard with the selected number of columns. Repeat the process to add more rows.
   
4. You can add any desired dashlets to the dashboard by clicking in an empty placeholder in a row. For complete details on adding and managing dashlets, see Working with Dashlets.

After custom dashboards are created, you can:

• Switch between dashboards by selecting an option from the dashboard selection list.
• Delete any custom dashboard.
• Import or export a dashboard.

Each dashboard has:

• The dashboard toolbar.
• The dashboard title and the dashboard selection list.
• Zero or more dashlets.

Working with DashletsWorking with Dashlets

Dashlets are the parts that make up a dashboard. NetWitness uses dashlets to display focused subsets of system information, services, jobs, resources, subscriptions, rules, and other information.

The controls for a dashlet are in the title bar. All dashlets use a common set of controls, and only those that apply to the particular dashlet appear in the title bar of the dashlet.

The following table displays the description of each icon on the dashlet.

You can add dashlets to the default dashboard or construct a custom dashboard with your own useful set of dashlets to make your workflow more efficient.

Add a Dashlet

To customize the views in NetWitness, you can add dashlets to a default dashboard or create custom dashboards. However, you cannot add dashlets to preconfigured dashboards.

To add a dashlet:

1. Navigate to any dashboard or create a new dashboard.
   
2. Click Add a Dashlet dialog.
3. Type a title for the dashlet. The title can include letters, numbers, special characters, and spaces.
4. If there are additional configurable fields for the dashlet, set appropriate values.
5. When all required fields have been configured, click Add.
   The dashlet is added to the dashboard in the selected placeholder and is automatically saved.
   

, ,,,,,,, ,,,,,,, you can drag and drop them and they can be swapped.,,,,,,, such as the Live Subscriptions dashlet, does not display the settings option in the title bar. Many dashlets have an editable title where you can edit the following properties:,,,,,, you can monitor only Decoders, or you can monitor Decoders and Concentrators.,,,,,, a Realtime Chart Dashlet has the settings option.,,,,,,, click settings ( ) in the dashlet title bar.
The Options dialog is displayed.

Edit any of the displayed properties. For example, in an in Operations - File Analysis Dashboard, edit Dashlet Refresh Interval from 15 to 20.

Click Apply.

,,,,, RE Alert Variance, and RE Realtime Charts dashlets on left-click:,,,,,, the data is automatically displayed on the dashlet, if the value is configured and listed on top.

,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, Hide Permanently, and Manage Hidden Values are not available for Geomap charts.,,,,,, it is a user-specific change. The changes made to a preconfigured dashboard are applicable only to your dashboard and cannot be viewed by other users who use the same preconfigured dashboard. For example, if you hide a value in an overview dashboard, the change is applicable only to your dashboard. If another user views the same overview dashboard, the value is still displayed. The same applies to a custom dashboard. When you hide a value in the custom dashboard and share the same dashboard with another user, the values are still displayed even though the dashboard is shared.,,, see the Dashboards Catalog in the NetWitness Content space on NetWitness Community.,,,,,,, ,,,,,,, ,,,,,,, hover in the header of the dashlet that you want to move.
The directional cursor appears over the dashlet. Click and hold in the header of the dashlet that you want to move.

Continue to hold the left mouse button and drag the window toward the new location.
The figure below shows a dashlet as it is being re-arranged.

Release the mouse button when the dashlet is in the desired location.
The dashlet that currently occupies that position moves down.

,,,,,,, ,,,,,,, for example some Reporting dashlets, are easier to view when maximized so that the entire contents is visible without scrolling.,,,,,, click the maximize control icon in the dashlet title bar: . The dashlet is displayed on full screen.,,,,,,, click the same control icon in the dashlet title bar: . The dashlet is restored to previous size.,,,,,,, ,,,,,,, ,,,,,,, if you want to delete. The dashlet is removed from the dashboard.
Click No, if you do not want to delete.,,,,,, the empty space is replaced by a placeholder where you can add another dashlet using the above Add a Dashlet procedure.,,,,,,, ,,,,,,, you can export your dashboards that are not currently in use. When you are ready to use a previously exported dashboard, import the dashboard into NetWitness.,,,,,, ,,,,,,, ,,,,,,, click (Import Dashboard).
The Import Dashboard dialog is displayed.

Browse to the dashboard file in the Import Dashboard dialog. You can import .cfg and .zip files.

Click Import.
The dashboard is displayed in NetWitness.

,,,,,,, ,,,,,,, the corresponding Reporting Engine contents is also exported.,,,,,,, provided they have equivalent permissions.,,,,,,, you must have the dashboard open to access the Export Dashboard option under the Edit drop-down menu in the dashboard toolbar.,,,,,,, click (Export Dashboard).
The exported file is saved in .zip format.,,,,,,, ,,,,,,, ,,,,,,, you can copy dashboards to the NetWitness dashboard or a custom dashboard. The NetWitness dashboard, as the name suggests, offers all NetWitness dashlets. The Copy Dashboard dialog creates a duplicate dashboard, which can be customized. When you copy a dashboard, the default name is prefixed with Copy of. For example, if the name of the original dashboard is XYZ, the default title of the copied dashboard will be Copy of XYZ., ,,,,,,, click .
The Copy Dashboard dialog is displayed. The following screenshot is an example of copying a dashboard.

Enter the Dashboard Title.

Click Copy.

,,,,,,, ,,,,,,, as an administrator you can share dashboards for viewing purposes with other roles such as Administrators, Analysts, Operators and so on. When you share a dashlet, the users can only view the dashboard, make dashboard as favorite, copy the dashboard, and export the dashboard. In case of other roles such as Analysts, Operators ,,,,,,, click and select the checkbox of the role with whom you want to share the dashboard.,,,,,,, ,,,,,,, clear the checkbox of the role. If a dashboard is shared, the dashboard name will be displayed with the share icon .,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, a scheduled job is triggered once a week on Sunday at 00:00.,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, if an Analyst UI is deployed for the EMEA SOC team, analysts can query their EMEA NetWitness Platform  hosts directly. If the EMEA team has Broker hosts and Concentrator hosts within the region, the Analyst UI can connect and query them instead of connecting back to Primary User Interface (Primary UI).,,,,, these features apply and affect the dashboards available to analysts:,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, the analyst must create a copy or contact the Admin to customize it.

When built-in preconfigured dashboards are enabled from an Admin UI, the dashboard is enabled for all the roles and for all the Analyst UIs. However, the data displayed in every Analyst UI is specific to the associated Reporting Engine.

By default, all the built-in preconfigured dashlets are disabled and can be enabled only from an Admin UI. Before you enable a preconfigured dashlet, you must set up the Live Services Account, see the Set Up Live Services topic in the Live Services Management Guide.

,, ,,,,,,, except all configurations must be performed from the Admin UI.,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,, ,,,,,,,