IBM Support

QRadar: Sharing Dashboard Items

Question & Answer


Question

How do I create and share a custom Dashboard Item that can be shared with other users?

Answer

To create a Dashboard Item that can be shared with other users, there are three main steps that need to be taken:
  1. Create and share the Search Criteria, that the Dashboard Item will use.
  2. Have Users modify the shared Search Criteria for use on their Dashboards.
  3. Have Users add the shared Search Criteria as a Dashboard Item.


Create and share the Search Criteria, that the Dashboard Item will use


The following steps can be used to create a search that can be used as a Dashboard Item for all users:

Note: The user account initiating this process must be in the Admin User Role. Only users in the Admin User Role have the ability to share saved Search Criteria.
Parameter Description
Search Name Type the unique name that you want to assign to this search criteria. You will provide this Search Name to other users that might want to use the search for their Dashboard Item.
Assign Search to Group(s) Select the check box for the group you want to assign this saved search. If you do not select a group, this saved search is assigned to the Other group by default. For more information, see Managing search groups.
Manage Groups If you want to manage search groups, click Manage Groups. For more information, see Managing search groups.
Timespan options: Choose one of the following options:
  • Last Interval (auto refresh) - Select this option to filter your search results while in auto-refresh mode. The Log Activity and Network Activity tabs refreshes at one-minute intervals to display the most recent information.
  • Recent - Select this option and from this list box, select the time range that you want to filter for.
  • Specific Interval - Select this option and from the calendar, select the date and time range you want to filter for.
Include in my Quick Searches If you want to include this search in your Quick Search list box on the toolbar, select this check box.
Include in my Dashboard This check box must be checked to include the data from your saved search on the Dashboard tab. For more information about the Dashboard tab, see Dashboard management.
Note: This parameter is only displayed if the search is grouped.
Set as Default If you want to set this search as your default search, select this check box.
Share with Everyone This check box must be checked to share the search criteria with all users.
  1. Choose one of the following options:
    • Click the Log Activity tab.
    • Click the Network Activity tab.
  2. Perform a search that uses at least one Group By option.
  3. Click Search.
  4. Click Save Criteria.
  5. Enter a Search Name.
  6. Assign the search to a Group.
  7. Click Include in my Dashboard.
  8. Click OK.


Have Users modify the shared Search Criteria for use on their Dashboards


The following steps are required by the Users that want to use the previously shared Search Criteria as a Dashboard Item:
 
  1. Choose one of the following options:
    • To add a Flow search Dashboard Item, click the Network Activity tab.
    • To add an Event search Dashboard Item, click the Log Activity tab
      Note: If the Log Activity, or Network Activity tabs are not visible, the User does not have proper permissions to view searches assigned to their User account.
  2. Navigate to Search > New Search.
  3. Select the Search Name of the shared search that was provided by the User in the Admin Role, from the Available Saved Searches list.
  4. Click the Load icon.
  5. Click any of the Search icons. The search results are displayed.
  6. Enter a new name for the search.
  7. Check the Include in my Dashboard check box.
  8. Click Save Criteria.
  9. Click OK.
     

Have Users add the shared Search Criteria as a Dashboard Item


Each user that wants to add the shared search as a Dashboard Item needs to do the following:
 
  1. Click the Dashboard tab.
  2. In the Show Dashboard list, select the Dashboard you want to add the new Dashboard Item to.
  3. Choose one of the following options:
    • To add a Log Activity search Dashboard Item, navigate to Add Item > Log Activity > Event Searches.
    • To add a Network Activity search Dashboard Item, navigate to Add Item > Network Activity > Flow Searches.
  4. Select the Search Name of the shared search, that was provided by the User in the Admin Role, from the list. The new Dashboard Item is now added to the Dashboard that you are currently on.



Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Dashboard","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3;7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
03 March 2020

UID

swg21679314

Page Feedback