Tracking the top five most active devices in the last ten minutes

In this example, you create a dynamic time series chart to track the top five most active devices in your environment in the last ten minutes. In QRadar® Pulse V2.1.4 or later, the time series chart has a dynamic series option that is useful when you don't know which devices you want to track, or find it difficult to make time series charts work properly. It automatically detects series and displays them as separate lines on the time series chart.

Before you begin

Read Time series charts in QRadar Pulse for background information.

1. Click Configure dashboard.

   The Configure dashboard screen displays a library of available widgets, with details about each widget.

2. Click Create new widget.
3. On the New Dashboard Item page, enter a name and a description for the item.
4. Select AQL from the data source list in the Query section, and enter the following AQL statement:

   SELECT MIN(starttime) as stime,
   LOGSOURCETYPENAME(devicetype) as device,
   devicetype as devices,
   count(*) as total
   FROM events
   WHERE devices IN (
      SELECT devices FROM (
          SELECT devicetype as devices,
          count(*) as topDevices
          FROM events
          where devicetype <> 368
          GROUP BY devices
          ORDER BY topDevices DESC
          LIMIT 3
          LAST 10 minutes
      )
   )
   GROUP BY starttime/(60*1000), device
   ORDER BY stime asc
   LAST 10 minutes

5. Keep the refresh time at every minute, and the results set at 1000.
6. Click Run Query.
7. In the Views section, call the chart Dynamic time series, and select Time Series Chart as the chart type.
8. On the General tab, configure the following options:
   1. From the Time (x-axis) list, select stime.
   2. Select the Dynamic Series option.
   3. Split the series by device.
   4. From the Values (y-axis) list, select total.
   5. Set Show Legend to Yes and set the orientation.
9. Click Save.

Results

The following screen capture is an example of what the chart looks like: