Create a dashboard widget

A dashboard widget displays data visualizations, metrics, or formatted text on a custom dashboard.

Use this procedure to create a data-based widget that visualizes a dataset as a chart or graph. To add a text-based widget using Markdown formatting, see Create a dashboard widget.

Tip: You can use Aurora Security Assistant to create widgets. For more information, see Aurora Security Assistant.

These resources are required:

  • A Managed Detection and Response (MDR) license.
  • Administrator permissions for the Arctic Wolf Unified Portal.

    You must be a primary or secondary contact. If you require this level of access, submit your request to a primary or secondary contact in your organization.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. Open a custom dashboard for editing using one of these methods:
  3. To create a widget without using a predefined dataset as your starting point, click Dashboard Actions > Add Custom Widget.
  4. To create a custom widget based on an existing widget:
    1. Insert a widget from the widget gallery or a dashboard:
      • To add a widget from the widget gallery — Click Dashboard Actions > Widget Gallery , and then click Add .
      • To copy a widget on the current dashboard — Click Actions > Duplicate.
      • To copy a widget from another dashboard — See Copy a widget to another dashboard.
    2. To edit a widget, click Actions > Edit.
  5. In the Query Builder section:
    1. Use operators to define a dataset for the widget.
      For more information, see Query Builder.
    2. Click Search Data.
      Search results appear in the Event Logs section.
    3. Review the Event Logs section to make sure that you have the desired dataset.
  6. In the Data Visualization Settings section:
    1. In the Chart Type list, select a data visualization option.
      More fields appear based on the selected Chart Type option.
    2. Fill in the fields for the selected Chart Type option.
      For more information, see Data visualization settings.
    3. In the Widget Name field, enter a name for the widget.
    4. Optional: In the Widget Description field, enter a brief description of the widget.
  7. In the Widget Size list, select a size for the widget, for example, three-quarter.
    Note:

    Widget content adapts based on size. Smaller sizes display summarized content, while larger sizes display expanded details.

  8. To preview the widget, click Update Visualization.
  9. If necessary, change the chart type or modify the dataset. Then, preview the widget again.
  10. Click Update Widget or Add Widget to Dashboard.

Example widgets

These are examples of widgets that you can add to a custom dashboard.

Create a lockouts by username widget

You can create a widget showing the top user accounts generating user lockout messages in an environment. Windows event code 4740 is the code for user lockout.

  1. Open a custom dashboard for editing.
  2. At the top of the dashboard, click Add Widget .
  3. For the first rule, enter these values:
    • Field — event.code
    • Operator — =
    • Value — 4740
  4. Click Search Data.
  5. In the Data Visualization Settings section, enter these values:
    • Chart Type — Vertical Bar Chart
    • Group By — user.name
      Tip: You can also group by host.hostname to see the top devices where user lockouts occur.
    • Aggregation — Count
    • Widget Name — Lockouts by Username
  6. Click Update Visualization.
    The data appears in a vertical bar chart.
  7. Click Add Widget to Dashboard.

Create a top 5 Sysmon events widget

You can create a widget showing the top events from Sysmon.

  1. Open a custom dashboard for editing.
  2. At the top of the dashboard, click Add Widget .
  3. In the first rule, enter these values:
    • Field — event.provider
    • Operator — =
    • Value — Microsoft-Windows-Sysmon
  4. Make sure that AND is selected.
  5. Click + Rule.
  6. In the new rule, enter these values:
    • Field — rule.description
    • Operator — Exists
  7. Click Search Data.
  8. In the Data Visualization Settings section, enter these values:
    • Chart Type — Horizontal Bar Chart
    • Group By — rule.description
    • Aggregation — Count
    • Widget Name — Sysmon Events
  9. Click Update Visualization.
    The data appears in a horizontal bar chart.
  10. Click Add Widget to Dashboard.

Create a Markdown widget

A Markdown widget displays formatted text content on a self-service dashboard, including headings, paragraphs, dividers, and tables.

Use a Markdown widget to add custom text content to your dashboard, such as instructions, notes, or summary tables. The widget supports a subset of Markdown syntax and includes edit and preview modes.

These resources are required:

  • A Managed Detection and Response (MDR) license.
  • Administrator permissions for the Arctic Wolf Unified Portal.

    You must be a primary or secondary contact. If you require this level of access, submit your request to a primary or secondary contact in your organization.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. Open a custom dashboard for editing.

    For more information, see Create a custom dashboard or Edit a custom dashboard.

  3. Click Dashboard Actions > Add Markdown Widget.
  4. In the editor, enter your content using Markdown syntax.

    Supported Markdown elements:

    • Headings — Use # Heading 1 through ###### Heading 6.
    • Paragraphs — Separate paragraphs with a blank line.
    • Horizontal rules — Use --- or *** to create a divider.
    • Tables — Use standard Markdown table syntax. Tables support up to 10 rows and 5 columns.
    Tip:

    Click Help in the widget editor for examples of supported syntax.

  5. Click Add Widget to Dashboard.