Importing sample dashboards

JSON files of preconstructed dashboards are available on the QRadar AQL data source configuration page. Use the sample dashboards as a reference for creating your own dashboards.

About this task

If you change a sample dashboard, you are prompted to save or overwrite your changes. If you want to save your changes to a new dashboard, click Save as. Otherwise, your changes are lost.
Important: If you save a copy of a sample dashboard, the unique identifier (UID) value in the dashboard's data link URL changes. You must update both the UID value and name in the data link URL of any dashboards that reference the dashboard that you saved. For more information, see Configure data links (https://grafana.com/docs/grafana/latest/panels-visualizations/configure-data-links/).
Note:

The following sample dashboards are available for import.

Table 1. IBM Security QRadar AQL Plugin sample dashboards
QRadar AQL - [dashboard_name] Description
QRadar AQL - Sample Dashboard Provides examples of basic AQL queries. The dashboard also provides examples of how returned data can be displayed on a Grafana dashboard.
QRadar AQL - Event and Flow Metrics Provides visibility on the basic metrics of event and flows data such as the average or peak event rate, the average or peak flow rate, and the latest log sources.
QRadar AQL - Miscellaneous Metrics Provides a series of miscellaneous queries to gather some metrics on disk usage, events per user, latest log sources excluding common log sources, and the average max event rate.
QRadar AQL - SOC Insights Provides a series of statistics about an environment, which you can use to view trends over time. Use the greatest and least talker statistics to help you quickly identify potential anomalies. A talker is a host that sends data, either from your network or to your network.

Procedure

  1. In your Grafana instance, from the navigation menu, click Administration > Data Sources.
  2. On the Data sources page, click the IBM® Security QRadar® AQL Plugin data source.
  3. On the IBM Security QRadar AQL Plugin page, click the Dashboards tab.
  4. Find the row of the sample dashboard that you would like to import and click Import.
  5. From the navigation menu, click the Dashboards icon (Grafana Dashboards icon).
  6. On the Dashboards page, click the sample dashboard that you imported.
    The sample dashboard is displayed.