Dashboards

Topics

What are Dashboards?

Dashboards provide a unified view of your data by combining multiple visualizations into a single, interactive interface. They allow security teams to monitor events, track metrics, and identify threats in real-time.

Dashboard is a collection of several visualizations or searches. Depending on how it is built and what visualization it contains, it can be designed for different teams e.g.:

  • SOC - which is responsible for detecting failures or threats in the company

  • Business - which thanks to the listings can determine the popularity of products and define the strategy of future sales and promotions

  • Managers and directors - who may immediately have access to information about the performance units or branches

Key Benefits

  • Unified Monitoring: View multiple data sources simultaneously

  • Real-time Updates: Automatic refresh of security metrics

  • Interactive Filtering: Drill down into specific events or time ranges

  • Sharing and Collaboration: Share dashboards with team members

  • Customizable Layouts: Arrange panels according to priorities

Dashboard vs Visualization - Understanding the Difference

The Relationship

Visualizations (Individual Charts)

  • Single metric or dataset representation

  • Reusable components

  • Can exist independently

Dashboards (Combined Overview)

  • Collection of multiple visualizations

  • Holistic view of system or security posture

  • Interactive and filterable

Building Security Dashboards

Dashboard Creation Process

Navigation: ELS Console → Dashboards → Create Dashboard

Konfiguracja dashboardu: źródła danych, visualization panels, układ

Step 1: Select Data Sources

  • Choose multiple index patterns (e.g., security-events-*, alerts-*).

  • Set a global time filter and query (e.g., environment: production).

Step 2: Add Visualization Panels

  • Essential Panels: Real-time alert feed, Threat map, Top risks table.

  • Arrangement: Place critical metrics at the top, detailed data at the bottom.

Step 3: Apply Filters

  • Use role-based or time-based filters to restrict data.

  • Example: Show data only for “critical_servers”.

Step 4: Save and Share

  • Name the dashboard and set permissions.

  • Schedule reports or embed in external systems.

Layout Best Practices

  • Structure: 3-4 columns, top-to-bottom priority.

  • Sizing: Larger panels for key metrics.

  • Spacing: Consistent margins for readability.

Creating Dashboards

Create

To create a dashboard from previously saved visualizations and queries, go to the “Dashboard” tab in the main menu. When you open it, a new page will appear.

Clicking on the icon “Add” at the top of the page select the “Visualization” or “Saved Search” tab.

and selecting a saved query and/or visualization from the list will add them to the dashboard. If, there are a large number of saved objects, use the bar to search for them by name.

Elements of the dashboard can be enlarged arbitrarily (by clicking on the right bottom corner of the object and dragging the border) and moving (by clicking on the title bar of the object and moving it).

Saving

You may change the time period of your dashboard.

At the upper right-hand corner, you may choose the time range of your dashboard.

Click save and choose ‘Store time with dashboard’ if you are editing an existing dashboard. Otherwise, you may choose ‘Save as a new dashboard’ to create a new dashboard with the new time range.

To save a dashboard, click on the “Save” button at the up of the query bar and give it a name.

Load

To load the Dashboard, go to the “Management Object” -> “Saved Object” -> “Dashboard” and select it from the list. From this place, we can also go into advanced editing mode. To view the visualization use button.

Sharing dashboards

The dashboard can be shared with other Energy Logserver users as well as on any page - by placing a snippet of code. Provided that it can retrieve information from Energy Logserver.

To do this, create a new dashboard or open the saved dashboard and click on “Share” at the top of the page. A window will appear with the generated two URLs. The content of the first one “Embaded iframe” is used to provide the dashboard in the page code, and the second “Link” is a link that can be passed on to another user. There are two options for each, the first is to shorten the length of the link, and the second is to copy to the clipboard the content of the given bar.

Dashboard drill down

In the discovery tab search for a message of Your interest

Save Your search

Check Your “Shared link” and copy it

! ATTENTION ! Do not copy "?_g=()" at the end.

Pre-built Security Dashboards

EnergyLogserver SIEM offers customizable dashboard templates.

Available Dashboards

Refer to SIEM Plan for pre-built options.

Usage

  • Steps: Navigate to Dashboards → Templates, select, configure, customize, save.

  • Tips: Add filters, adjust time ranges, use branding colors.