Graylog2 / Graylog2/graylog2-server

Create Replay Search 'Dashboards' For Event Definitions

Open
#17,922 0 comments 0 reactions 1 assignee Claimed by @Emy-01 View on GitHub
feature Roadmap 2025 Candidate triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

What?
The ability to create and save a dashboard with preconfigured widgets and assign them to an event definition, incorporating field values from a triggered event as URL query parameters to the dashboard for use within widget queries.

Why?
As an example, when we receive a detection/incident email from our EDR and click the link to open the event in the portal, an initial landing page appears. This page provides quick at-a-glance information about the activity that triggered the alert, along with additional 'aggregations,' such as lists/counts of different types of activity carried out by the process (DNS/Network Connections, etc.) over the last time period.

As an analyst, this immediately provides you with context around what has happened and recent activity leading up to the alert. It allows you to identify points of interest that warrant further investigation, which you can then carry out by pivoting to the event search and querying the raw telemetry.

It would be useful to achieve similar behavior using preconfigured widgets for alerts generated by graylog such as alerts we have setup on a Sysmon stream.

Currently in Graylog, the replay search provides you with the message(s) that triggered the alert. From there, you will have to add relevant fields to the message table or load a saved search or dashboard, etc., to continue the investigation.

Outside of the sysmon/security example, I guess this will be beneficial for anyone whose current workflow involves manually doing: Event Definition Triggered -> Replay Search -> Load Dashboard/Saved Search with parameters from event -> ...

## Your Environment
* Graylog Version: 5.2.2 Cloud

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.