Importing sample dashboards
JSON files of preconstructed dashboards are available on the QRadar AQL data source configuration page. Use the sample dashboards as a reference for creating your own dashboards.
About this task
Important: If you save a copy of a sample dashboard, the unique
identifier (UID) value in the dashboard's data link URL changes. You must update both the UID value
and name in the data link URL of any dashboards that reference the dashboard that you saved. For
more information, see Configure data links
(https://grafana.com/docs/grafana/latest/panels-visualizations/configure-data-links/).
Note:
The following sample dashboards are available for import.
QRadar AQL - [dashboard_name] | Description |
---|---|
QRadar AQL - Sample Dashboard | Provides examples of basic AQL queries. The dashboard also provides examples of how returned data can be displayed on a Grafana dashboard. |
QRadar AQL - Event and Flow Metrics | Provides visibility on the basic metrics of event and flows data such as the average or peak event rate, the average or peak flow rate, and the latest log sources. |
QRadar AQL - Miscellaneous Metrics | Provides a series of miscellaneous queries to gather some metrics on disk usage, events per user, latest log sources excluding common log sources, and the average max event rate. |
QRadar AQL - SOC Insights | Provides a series of statistics about an environment, which you can use to view trends over time. Use the greatest and least talker statistics to help you quickly identify potential anomalies. A talker is a host that sends data, either from your network or to your network. |
Procedure
- In your Grafana instance, from the navigation menu, click .
- On the Data sources page, click the IBM® Security QRadar® AQL Plugin data source.
- On the IBM Security QRadar AQL Plugin page, click the Dashboards tab.
- Find the row of the sample dashboard that you would like to import and click Import.
-
From the navigation menu, click the Dashboards icon (
).
-
On the Dashboards page, click the sample dashboard that you
imported.
The sample dashboard is displayed.