Widgets

The IBM® Security QRadar® Network Visibility workspace comprises dashboards and widgets. Use it to create an inventory of unique dashboards to track endpoint, user, cloud, department, and company-wide security and operational data.

Moving, resizing, and deleting widgets

Widgets can be moved up and down to a more desirable location on the dashboard. To move a widget, drag the title and place it in its new location.

Widgets can be resized by dragging it from the lower right and adjusting to fit in your wanted location.

You can remove widgets from your dashboard to accurately populate the widget in scenarios where your environment is lacking the required data (for example, your deployment does not contain QRadar Network Insights). To remove a widget, click the three dots icon in the upper right and select the Remove option.

Figure 1. Remove widget

Editing thresholds

Many of the widgets have threshold values pre-defined to highlight potential issues that you might want to investigate. Depending on your environment, you can adjust these values to reflect what is considered an issue for you. To adjust these values, click the edit icon in the upper right of any widget and scroll to the Thresholds tab in the Views section.. Adjust the values and colors to reflect the most appropriate values for your environment and save your changes.

Figure 2. Thresholds tab

Changing themes

Having the right color palette and theme can make your dashboards stand out whether they are on your SOC wall or for your own personal use. For more information, see Changing the workspace theme and branding (https://www.ibm.com/docs/en/qradar-common?topic=workspaces-changing-workspace-theme-branding).

Customizing widget colors

Some widgets allow for customization of the colors and symbols that are used in the visualizations. To explore what colors and symbols you can customize, click the edit icon in the upper right of the widget.

Adjusting the results limit

Every widget has a Results Limit that restricts the number of entries that are returned by the AQL query. This value is pre-defined and restricts the amount of data each widget can display.

Important: When you process large volumes of traffic, or you increase the AQL Time Criteria parameter, some results might be omitted if a limit is set, especially in time series widgets.

To adjust this value, click the edit icon in the upper right of any widget and edit the Results Limit input field.

Figure 3. Results Limit input field