This document explains how to use the Dashboards feature of Google Security Operations to build visualizations
over different data sources. It's composed of different charts,
which are populated using YARA-L 2.0 properties.
Before you begin
Ensure that your Google SecOps instance has the following enabled:
Dashboards provide insights into security events, detections, and related data.
This section outlines the supported data sources and explains how role-based access
control (RBAC) affects visibility and data access within the dashboards.
Data sources supported
Dashboards include the following data sources, each with its corresponding YARA-L prefix:
Data role-based access control (RBAC) is a security model that uses
individual user roles to restrict user access to data within an organization.
Data RBAC lets administrators define scopes and assign them to users, ensuring
access is limited to only the data necessary for their job functions.
All queries in dashboards follow data RBAC rules.
For more information about access controls and scopes, see Access controls and scopes in data RBAC.
Events, entity graph, and IOC matches
The data returned from these sources is restricted to the user's assigned access scopes, ensuring that they only see results from authorized data.
If a user has multiple scopes, queries include data from all assigned scopes.
Data outside the user's accessible scopes doesn't appear in dashboard search results.
Rules
Users can only see rules that are associated with their assigned scopes.
Detection and rulesets with detections
Detections are generated when incoming security data matches the criteria defined
in a rule. Users can only see detections that originate from rules associated with
their assigned scopes. The rulesets with detections are only visible to
global users.
SOAR data sources
Cases and alerts, playbooks, and case history are only visible to global users.
Ingestion metrics
Ingestion components are services or pipelines that bring logs into the platform
from source log feeds. Each ingestion component collects a specific set of log
fields within its own ingestion metrics schema. These metrics are only visible to
global users.
Advanced features and monitoring
To fine-tune detections and improve visibility, you can use advanced configurations, such as YARA-L 2.0 rules and ingestion metrics. This section explores these feature insights, helping you optimize detection efficiency and monitor data processing.
YARA-L 2.0 properties
YARA-L 2.0 has the following unique properties when used in dashboards:
Additional data sources, such as entity graph, ingestion metrics, rule sets,
and detections are available in dashboards. Some of these data sources are not yet available
in YARA-L rules and Unified Data Model (UDM) search.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eNative Dashboards in Google Security Operations allow users to create visualizations from various data sources using YARA-L 2.0 properties.\u003c/p\u003e\n"],["\u003cp\u003eAccessing and interacting with Native Dashboards requires specific IAM permissions, such as the ability to list, view, create, duplicate, update, and delete dashboards.\u003c/p\u003e\n"],["\u003cp\u003eNative Dashboards support multiple data sources, including events, entity graphs, ingestion metrics, rule sets, detections, and IOCs, each with distinct query time intervals and YARA-L prefixes.\u003c/p\u003e\n"],["\u003cp\u003eData role-based access control (RBAC) restricts data visibility within Native Dashboards to only the data that users have been granted access to based on their assigned roles and scopes.\u003c/p\u003e\n"],["\u003cp\u003eYARA-L 2.0 queries used in Native Dashboards must include a \u003ccode\u003ematch\u003c/code\u003e or \u003ccode\u003eoutcome\u003c/code\u003e section, and the \u003ccode\u003eevents\u003c/code\u003e and \u003ccode\u003econdition\u003c/code\u003e sections of a YARA-L rule are handled implicitly or are unavailable, respectively.\u003c/p\u003e\n"]]],[],null,["Dashboards overview \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nThis document explains how to use the Dashboards feature of Google Security Operations to build visualizations\nover different data sources. It's composed of different charts,\nwhich are populated using YARA-L 2.0 properties.\n\nBefore you begin\n\nEnsure that your Google SecOps instance has the following enabled:\n\n- [Configure a Google Cloud project](/chronicle/docs/onboard/configure-cloud-project)\n or migrate your Google SecOps instance to an [existing cloud project](/chronicle/docs/onboard/link-chronicle-cloud).\n\n- Configure a [Google Cloud Identity provider](/chronicle/docs/onboard/configure-cloud-authentication)\n or [third-party identity provider](/chronicle/docs/onboard/configure-authentication).\n\n- [Configure feature access control using IAM](/chronicle/docs/onboard/configure-feature-access).\n\nIAM permissions required\n\nThe following permissions are required to access dashboards:\n\n| IAM permission | Purpose |\n|----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `chronicle.nativeDashboards.list` | [View the list of all dashboards](/chronicle/docs/reports/manage-native-dashboards#view-dashboards). |\n| `chronicle.nativeDashboards.get` | [View a dashboard](/chronicle/docs/reports/manage-native-dashboards#view-a-dashboard), [apply a dashboard filter](/chronicle/docs/reports/native-dashboards-filters#apply-filter), and [apply the global filter](/chronicle/docs/reports/native-dashboards-filters#apply-global-time-filter). |\n| `chronicle.nativeDashboards.create` | [Create a new dashboard.](/chronicle/docs/reports/manage-native-dashboards#new-dashboards) |\n| `chronicle.nativeDashboards.duplicate` | [Make a copy of an existing dashboard.](/chronicle/docs/reports/manage-native-dashboards#copy-dashboards) |\n| `chronicle.nativeDashboards.update` | [Add and edit charts](/chronicle/docs/reports/manage-native-dashboard-charts), [add a filter](/chronicle/docs/reports/native-dashboards-filters#add-filter), [change dashboard access](/chronicle/docs/reports/manage-native-dashboards#change-dashboard-access), and [manage the global time filter](/chronicle/docs/reports/native-dashboards-filters#manage-global-time-filter). |\n| `chronicle.nativeDashboards.delete` | [Delete a dashboard](/chronicle/docs/reports/manage-native-dashboards#delete-dashboards). |\n\nUnderstand dashboards\n\nDashboards provide insights into security events, detections, and related data.\nThis section outlines the supported data sources and explains how role-based access\ncontrol (RBAC) affects visibility and data access within the dashboards.\n\nData sources supported\n\nDashboards include the following data sources, each with its corresponding YARA-L prefix:\n\n| Data source | Query time interval | YARA-L prefix | Schema |\n|-------------------|---------------------|----------------|----------------------------------------------------------------------------------------|\n| Events | 90 days | `no prefix` | [Fields](/chronicle/docs/reference/udm-field-list) |\n| Entity graph | 365 days | `graph` | [Fields](/chronicle/docs/reference/udm-field-list#udm_entity_data_model) |\n| Ingestion metrics | 365 days | `ingestion` | [Fields](/chronicle/docs/reference/ingestion-metrics-schema) |\n| Rule sets | 365 days | `ruleset` | [Fields](/chronicle/docs/reference/yaral-functions-native-dashboards#rule_sets_fields) |\n| Detections | 365 days | `detection` | [Fields](/chronicle/docs/reference/rest/v1alpha/Collection) |\n| IOCs | 365 days | `ioc` | [Fields](/chronicle/docs/reference/yaral-functions-native-dashboards#ioc_fields) |\n| Rules | No Time limit | `rules` | [Fields](/chronicle/docs/reference/yaral-functions-native-dashboards#rule_fields) |\n| Cases and alerts | 365 days | `case` | [Fields](/chronicle/docs/reference/soar-data-dashboard#cases-and-alerts) |\n| Playbook | 365 days | `playbook` | [Fields](/chronicle/docs/reference/soar-data-dashboard#playbook) |\n| Case history | 365 days | `case_history` | [Fields](/chronicle/docs/reference/soar-data-dashboard#case-history) |\n\nImpact of data RBAC\n\nData role-based access control (RBAC) is a security model that uses\nindividual user roles to restrict user access to data within an organization.\nData RBAC lets administrators define scopes and assign them to users, ensuring\naccess is limited to only the data necessary for their job functions.\nAll queries in dashboards follow data RBAC rules.\nFor more information about access controls and scopes, see [Access controls and scopes in data RBAC](/chronicle/docs/administration/datarbac-overview#access-control-with-scopes-labels).\n\nEvents, entity graph, and IOC matches\n\nThe data returned from these sources is restricted to the user's assigned access scopes, ensuring that they only see results from authorized data.\nIf a user has multiple scopes, queries include data from all assigned scopes.\nData outside the user's accessible scopes doesn't appear in dashboard search results.\n\nRules\n\nUsers can only see rules that are associated with their assigned scopes.\n\nDetection and rulesets with detections\n\nDetections are generated when incoming security data matches the criteria defined\nin a rule. Users can only see detections that originate from rules associated with\ntheir assigned scopes. The rulesets with detections are only visible to\n[global users](/chronicle/docs/administration/datarbac-overview#user-roles).\n\nSOAR data sources\n\nCases and alerts, playbooks, and case history are only visible to [global users](/chronicle/docs/administration/datarbac-overview#user-roles).\n\nIngestion metrics\n\nIngestion components are services or pipelines that bring logs into the platform\nfrom source log feeds. Each ingestion component collects a specific set of log\nfields within its own ingestion metrics schema. These metrics are only visible to\n[global users](/chronicle/docs/administration/datarbac-overview#user-roles).\n\nAdvanced features and monitoring\n\nTo fine-tune detections and improve visibility, you can use advanced configurations, such as YARA-L 2.0 rules and ingestion metrics. This section explores these feature insights, helping you optimize detection efficiency and monitor data processing.\n\nYARA-L 2.0 properties\n\nYARA-L 2.0 has the following unique properties when used in dashboards:\n\n- Additional data sources, such as entity graph, ingestion metrics, rule sets,\n and detections are available in dashboards. Some of these data sources are not yet available\n in YARA-L rules and Unified Data Model (UDM) search.\n\n- See [YARA-L 2.0 functions for Google Security Operations dashboards](/chronicle/docs/reference/sample-yaral-for-native-dashboard#yara-l-functions-native-dashboards)\n and aggregate functions that include statistical measures.\n\n- The query in YARA-L 2.0 must contain a `match` or an `outcome` section, or both.\n\n- The `events` section of a YARA-L rule is implied and does not need to be declared in queries.\n\n- The `condition` section of a YARA-L rule is not available for dashboards.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
