QRadar Pulse Dashboard Components and Workspaces
The QRadar Pulse workspace comprises dashboards and dashboard items. Use it to create an inventory of unique dashboards to track endpoint, user, department, and company-wide security and operational data.
Your workspace is what you see when you click the Pulse tab on the QRadar Console. Only you can see your workspace, but you can choose to share dashboards with colleagues or expand specific dashboards onto a monitor on a SOC wall. Create AQL parameters for your workspace that make it simpler to create AQL dashboard items and to update multiple AQL queries at the same time.
The following image shows the default workspace view of the Offenses overview dashboard.
Use the default dashboard templates in QRadar Pulse as a starting point to build your own customized dashboard inventory for your workspace. Each dashboard template offers several different dashboard items, which you can add to different dashboards. Remove the dashboard items that don't apply to your organization.
The QRadar Pulse dashboards get their data from QRadar, so some of them might display data, such as the Events and flow metrics dashboard, immediately depending on how you set QRadar up to receive data. Other QRadar Pulse dashboards must be edited to get data to appear in the charts.
Dashboards contain dashboard items that monitor and display security events and issues that are important to your organization. For example, the Offense overview dashboard contains dashboard items that monitor the top offense categories, most severe offenses, and so on. Create your own dashboards specific to your organizational and network needs. Add dashboard items from other dashboard templates or create your own. Import dashboards that colleagues share with you to eliminate the need for re-creating existing content.
Dashboard items contain a data source (AQL or offense) and a minimum of one chart. You can add more charts as different views, such as a pie or bar chart. For example, the Events per User dashboard item in the Miscellanous metrics dashboard can display as a pie or a bar chart. The bar chart view compares sets of data between groups, such as usernames and the number of events per user. The pie chart view displays the same information, but in percentages.
Parameters for AQL Data Sources
Parameters help make it simple to reuse common elements in multiple AQL queries so that it's easier to create dashboard items and share them. Create parameters that you can use in all of your dashboard items with an AQL data source, such as Time Period and Time Value. Using common parameters and default values can reduce the time that it takes to create or edit individual AQL queries for your dashboard items.