The recent version of pulse introduced new drill down capabilities from table items in a dashboard (in the near future it is planned to enable drill down from other types of dashboard items as well). The drill down is very flexible and enables drill down to
a) an external URL
b) the same dashboard
c) a different dashboard
Lets look at each of these in turn.
Drill down to an external URL
This drill down allows a URL to be defined that when clicked passes values into a pre-configured URL and then opens that URL. A simple example of this is to create a table showing offenses and then define a URL to open the standard QRadar Offense screen when an offense is clicked on. This can be done as follows. Firstly define the data for the table, by select 'Offense' as the source.
Then select tabular display and setup the drill down.
Scroll down to the table item configuration and select the 'Drill Down' tab. From the 'Type' drop down select 'Open a URL', and enter the URL that you want to drill down to. You will want to pass values from your dashboard item data into the URL. To do this define parameters in the URL using {}. You can see in the above example {offense_id} has been defined as a variable. Once you do this, drop downs will appear below that let you map your variable onto one the fields in the dashboard item data. In this example the {offense_id} variable will be replaced with the value of 'id' from the data when the user clicks on the corresponding row in the table.
And that is it. Save the dashboard item and try it out.
Drilling down the same Dashboard
This may seem a little odd a first glance, but it is a very powerful feature that enables a user to click on a row in a table, and have other dashboard items on the dashboard automatically refresh to display information related to the clicked on row in the table.
Below is a simple example. The user clicks an offense in the table on the left and then the dashboard items on the right automatically update to reflect the details of data from within the offense
Lets look at how this is setup. Firstly we have to setup the dashboard items that we will refresh when a new offense is clicked on. Lets look at the setup of the 'Offense Log Source' item. We are showing the data in this item using AQL.
This dashboard items shows the distribution of log source types for the data in the offense. You can see two parameters defined {OffenseId} and {starttime}. Once this dashboard item is created Pulse will automatically create these two items as dashboard parameters as shown below
We can repeat a similar process for the other two items, Offense URLs and Offense Events, as shown below
and
Finally now we can create our main offense table with the drill down defined. Lets create the table first by defining 'Offense' as the source
Here we have include magnitude, description, id and start_time in our data. Next we put them in a table and define the drill downs.
Under 'Type' we have selected "Open a Pulse Dashboard" and because of this we then get to pick the dashboard we want to drill down to. So we pick our current one. Pulse will then show you parameters for the dashboard which, because of our setup above, will show OffenseId and Starttime, that you want to drill down to and let you map data fields from the dashboard item to these dashboard parameters. Finally you select if you want the dashboard being drill down into to be opened in a new window or refreshed in the current one, then save this item and you are good to go. Give it a go !
Drilling down to a different dashboard
Creating a drill down to a different dashboard item is simply a matter of selecting a different dashboard from the dashboard drop down in the 'drill down' section of the table setup. If you do this and select 'Display in current window', Pulse will automatically create a breadcrumb trail for the user so they can easily move back again to the dashboard they clicked on in the first place.
Of course it is possible to create many levels of dashboard drill down, but the breadcrumb trail will keep track of that for the user and make it very easy for them to see where they are and easily move back to any dashboard in the drill down process.
These new drill down capabilities are very powerful and we are really looking forward to seeing them in use ! If you'd like to use the example above as a starting point I've include a link to it
here Chris