Native Dashboards overview

Supported in:

This document explains how to use the Native Dashboards feature of Google Security Operations to build visualizations over different data sources. It's composed of different charts, which are populated using YARA-L 2.0 properties.

Before you begin

Ensure that your Google SecOps instance has the following enabled:

IAM permissions required

The following permissions are required to access Native Dashboards:

IAM permission Purpose
chronicle.nativeDashboards.list View the list of all Native Dashboards.
chronicle.nativeDashboards.get View a Native Dashboard, apply a dashboard filter, and apply the global filter.
chronicle.nativeDashboards.create Create a new Native Dashboard.
chronicle.nativeDashboards.duplicate Make a copy of an existing dashboard.
chronicle.nativeDashboards.update Add and edit charts, add a filter, change dashboard access, and manage the global time filter.
chronicle.nativeDashboards.delete Delete a Native Dashboard.

Understand Native Dashboards

Native Dashboards provide insights into security events, detections, and related data. This section outlines the supported data sources and explains how role-based access control (RBAC) affects visibility and data access within the dashboards.

Data sources supported

Native Dashboards include the following data sources, each with its corresponding YARA-L prefix:

Data source Query time interval YARA-L prefix Schema
Events 90 days no prefix Fields
Entity graph 365 days graph Fields
Ingestion metrics 365 days ingestion Fields
Rule sets 365 days ruleset Fields
Detections 365 days detection Fields
IOCs 365 days ioc Fields

Impact of data RBAC

Data role-based access control (RBAC) is a security model that uses individual user roles to restrict user access to data within an organization. Data RBAC lets administrators define scopes and assign them to users, ensuring access is limited to only the data necessary for their job functions. All queries in Native Dashboards follow data RBAC rules. For more information about access controls and scopes, see Access controls and scopes in data RBAC.

Detections and analysis

Effective threat detection depends on analyzing events, entity relationships, and IOC matches. This section describes how detections work, how entity graphs aid investigations, and how rulesets improve detection.

Events, entity graph, and IOC matches

The data returned from these sources is restricted to the user's assigned access scopes, ensuring that they only see results from authorized data. If a user has multiple scopes, queries include data from all assigned scopes. Data outside the user's accessible scopes doesn't appear in search results.

Detection and rulesets with detections

Detections are generated when incoming security data matches the criteria defined in a rule. Users can only see detections that originate from rules associated with their assigned scopes.

Advanced features and monitoring

To fine-tune detections and improve visibility, you can use advanced configurations, such as YARA-L 2.0 rules and ingestion metrics. This section explores these feature insights, helping you optimize detection efficiency and monitor data processing.

YARA-L 2.0 properties

YARA-L 2.0 has the following unique properties when used in Native Dashboards:

  • Additional data sources, such as entity graph, ingestion metrics, rule sets, and detections are available in dashboards. Some of these data sources are not yet available in YARA-L rules and Unified Data Model (UDM) search.

  • See YARA-L 2.0 functions for Google Security Operations Native Dashboards and aggregate functions that include statistical measures.

  • The query in YARA-L 2.0 must must contain a match or an outcome section, or both.

  • The events section of a YARA-L rule is implied and does not need to be declared in queries.

  • The condition section of a YARA-L rule is not available for dashboards.

Ingestion metrics

Ingestion components are services or pipelines that bring logs into the platform from source log feeds. Each ingestion component collects a specific set of log fields within its own ingestion metrics schema. These metrics are only visible to global users.

Need more help? Get answers from Community members and Google SecOps professionals.