Dashboards

Learn about how to create custom Spyderbat dashboards and dashboard cards using Lucene Search or existing dashboard templates, as well as how to share and manage access to the custom dashboards.

Published: July 20, 2023

If you are looking for information on out-of-the-box Spyderbat Dashboards, please check out All About Spyderbat Dashboards and Spyderbat Dashboard Categories articles.

In addition to a number of dashboard cards in 7 different default dashboard categories, Spyderbat users with adequate permissions are able to create custom dashboard cards and categories for their organization in the Spyderbat UI.

In this article we will discuss:

• Creating a brand new dashboard card from scratch

• Creating a new dashboard card off an existing dashboard card

• Managing custom dashboards and dashboard cards

How To Create a Dashboard and a Dashboard Card from Scratch

As we have explained previously, each individual dashboard card represents a structured output of a Lucene search query. Therefore, if you decided to create a brand new set of dashboard cards by building custom search queries, then you will start by going into the Search section, which is the second from the top in the left hand navigation panel:

If you are starting to build out a brand new query, you will have an empty query field and the default search window set to 1 hour back. You can use the Query Builder Assistant to help create your search query or type up a Lucene query expression manually. For example, let’s say we want to pull a list of red flags (individual security detections) with Critical Severity for a host with a specific machine UID. We can use Search Query Builder Assistant to select the following parameters and send them to Search:

Please note, that once you clicked “Send To Search” button, the Query Builder Assistant will close itself out and you will be back to the Search window. Once you have confirmed the desired search time range, you will need to click “Search” in the actual Search window to trigger your search:

Once you ran the query and validated the results, you are able to save it in the form of a dashboard card, if you would like to be able to get back to it on a regular basis without having to rebuild every time:

Here you will be prompted to give your dashboard card a name or use the proposed default based on your query context, select a dashboard card type based on the data you are pulling in, and associate this card with a specific dashboard category.

Keep in mind, that you cannot add custom dashboard cards to any of the existing default dashboards, and you must create one or more of your own categories. These can be created directly from the “Save Dashboard Card” menu:

…or from the Dashboards section by clicking the “+” in the upper right corner of the screen:

How to Build a New Dashboard Card Off an Existing Card

Perhaps, an easier way to create custom dashboard cards is by tweaking some of the existing out-of-the-box cards that are available in the Spyderbat UI.

For example, let’s take a look at one of the Security cards named “Recent Spydertraces with Score >50”. Assume you would like to prioritize your focus on Spydertraces with much higher severity scores of 100+. The quickest way to build out a dashboard card like that would be to take the existing card and click “Run In Search”:

You can see the full query and can easily find the parameter to modify, which would be the score:

Once you update the score value to “>100”, you can save this as a new Dashboard Card and place it into your custom Dashboard category of choice to be easily accessible. You can also set notifications to be alerted if there is data pulling into that custom card.

One thing to keep in mind: you cannot edit a query in the custom dashboard card. If you saved a card and then decided to further tweak it, you will need to follow the steps outlined above: select a card you wish to modify, click “Run in Search”, update the query as desired, and save as a new dashboard card.

How to Manage Custom Dashboards

Once you have created a number of custom dashboards and dashboard cards, they will be visible to all the users in your organization in the Spyderbat UI. Users with adequate permissions will be able to rename dashboards and cards, add new dashboard cards to customer dashboards created by other users and delete dashboard cards and entire dashboards.

All dashboard management options can be accessed by clicking on the “pencil” icon in the upper right corner of the custom Dashboard, you wish to modify:

Here you can do a number of things:

• See if you have configured notifications for any of the cards in your custom dashboard.

• Hide a dashboard card from view by using the on/off slider on the left side of the dashboard card name

• Delete a dashboard card by clicking the “x” icon (Note: you will not be prompted to confirm your deletion, but it won’t be applied until you click “Save” in the lower right corner of the Edit window)

• Rename a dashboard card by clicking a “pencil” icon and then a “save” icon that looks like a floppy disk

• Change the order of appearance for the dashboard cards within the dashboard by dragging and dropping the “=” on the right hand side of the respective dashboard card names

• Rename the Dashboard category by clicking the ellipsis (three vertical dots) and selecting the “Edit Dashboard Name” option

All these changes will only apply after you click “Save” and will be in effect for all users in your organization, as stated on the next screen:

You can also delete an entire dashboard with all the cards in it by selecting “Delete Dashboard + Cards”, in which case you will need to confirm your decision:

Custom user-created dashboards will appear in the front positions of the category menu, pushing all default out-of-the-box categories to the right. The order of dashboard categories cannot be modified at this time, and categories cannot be hidden from view.