Graylog2 / Graylog2/graylog2-server
Create Replay Search 'Dashboards' For Event Definitions
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
What?
The ability to create and save a dashboard with preconfigured widgets and assign them to an event definition, incorporating field values from a triggered event as URL query parameters to the dashboard for use within widget queries.
Why?
As an example, when we receive a detection/incident email from our EDR and click the link to open the event in the portal, an initial landing page appears. This page provides quick at-a-glance information about the activity that triggered the alert, along with additional 'aggregations,' such as lists/counts of different types of activity carried out by the process (DNS/Network Connections, etc.) over the last time period.
As an analyst, this immediately provides you with context around what has happened and recent activity leading up to the alert. It allows you to identify points of interest that warrant further investigation, which you can then carry out by pivoting to the event search and querying the raw telemetry.
It would be useful to achieve similar behavior using preconfigured widgets for alerts generated by graylog such as alerts we have setup on a Sysmon stream.
Currently in Graylog, the replay search provides you with the message(s) that triggered the alert. From there, you will have to add relevant fields to the message table or load a saved search or dashboard, etc., to continue the investigation.
Outside of the sysmon/security example, I guess this will be beneficial for anyone whose current workflow involves manually doing: Event Definition Triggered -> Replay Search -> Load Dashboard/Saved Search with parameters from event -> ...
## Your Environment
* Graylog Version: 5.2.2 Cloud
Contributor guide
Assessment
This issue has not been assessed yet.