Skip to main content

Dashboards

A dashboard is the rendered face of a report: the widgets a report processor emits, laid out as a page someone can read without knowing any FPL. This page covers what a dashboard is made of, the widget types available, how the Scheduled and On-Demand groupings differ, and how to design a dashboard that answers its question at a glance.

What a Dashboard Is​

A dashboard is not authored separately from its report — it is the output of a report processor in the Dashboard Reports category, rendered as widgets. If you are arriving from another SIEM, note that there is no drag-and-drop dashboard builder to look for: you change a dashboard by editing the processor behind it.

Dashboards and Report Processors​

A dashboard stands in a one-to-one relationship with the processor that produces it — editing the processor is how the dashboard changes.

Where Dashboards Appear​

The card grid on Reports → Dashboard (/reports/Dashboard), three cards per row, each card titled with the report name and previewing its widgets as thumbnail tiles. Reports that have never run show Report has not been run yet instead of a preview.

Dashboards page showing the Scheduled Reports tab with five report cards, two displaying Report has not been run yet

The page header reads Dashboards with the subtitle A list of all dashboards grouped by type, and the two tabs above the grid — Scheduled Reports (selected by default) and On-Demand Reports — switch which group is shown.

Dashboards Elsewhere in the Product​

Report dashboards are distinct from the fixed dashboards elsewhere in the interface — the Home landing dashboard and the SIEM → Overview Summary page — which are not built from report processors and cannot be edited.

Scheduled vs. On-Demand​

The two tabs that group the dashboard gallery, and the real difference behind them.

Scheduled Reports​

Dashboards whose report runs on a recurrence, so the dashboard always shows the most recent scheduled run. The default tab.

On-Demand Reports​

Dashboards whose report is run manually, typically with arguments supplied per run — an investigation report scoped to one user, for example. The displayed content reflects whoever ran it last, with whatever arguments they chose, which is a trap if the dashboard is shared.

Choosing Between Them​

The decision rule: recurring operational and executive reporting is scheduled; per-subject investigation is on demand.