Widgets display data related to the Security Operations Center (SOC) status,
derived from cases, alerts, and playbooks.
This widget demonstrates the efficiency of alert grouping
by displaying the percentage of alerts that have been grouped into cases,
thereby reducing the number of individual alerts requiring investigation.
For example, the Alert Reduction widget shows the ratio of
cases to alerts. The formula is 1 - ( Cases / Alerts ) * 100%.
Therefore, four alerts are grouped into three cases, the number of alerts that
require investigation is reduced by 25% since there are three cases instead of
four.
After adding a dashboard, add the widgets needed per your requirement. You can
add up to 12 widgets in a dashboard.
Add a widget to a SOAR dashboard
Go to Dashboards & Reports > SOAR Dashboards
Click
add
Add Widget.
In the Widget Settings dialog that appears, enter a meaningful title
for the new widget. This step is mandatory. The time and environment you
specify when creating the dashboard applies to all widgets of that
dashboard. These fields are auto-populated based on the selection in the
dashboard the widgets are being added to.
Choose a Widget Width.
Select the form of the data display.
By default, the data display is in the form of a Pie Chart. Other forms you
can select include Horizontal Bar graph, Vertical Bar graph and Table.
For the chosen data display form, specify its corresponding fields in the
left pane. For example: If you chose Pie Chart as the data
display form, its corresponding fields are Number of, Calculate
field, Group by, Number of Results, and Order by.
For more information on the data display form and corresponding fields,
refer to Data Display Forms.
Depending on whether you choose Cases or Alerts – the
Group By options will display differently.
In the Filters pane, select the required filters for the data
you want to display. If the filter you want is not in the provided top
15 list, then you can search for it and add it in.
Click Save. The new widget with the specified data form, parameters and filters,
is added to the dashboard.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Add SOAR Dashboard widgets\n==========================\n\nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc) \n\nWidgets display data related to the Security Operations Center (SOC) status,\nderived from cases, alerts, and playbooks.\nThis widget demonstrates the efficiency of [alert grouping](/chronicle/docs/soar/investigate/working-with-alerts/alert-grouping-mechanism-admin)\nby displaying the percentage of alerts that have been grouped into cases,\nthereby reducing the number of individual alerts requiring investigation.\n\n\nFor example, the **Alert Reduction** widget shows the ratio of\ncases to alerts. The formula is *1 - ( Cases / Alerts ) \\* 100%*.\nTherefore, four alerts are grouped into three cases, the number of alerts that\nrequire investigation is reduced by 25% since there are three cases instead of\nfour.\n\n\nAfter adding a dashboard, add the widgets needed per your requirement. You can\nadd up to 12 widgets in a dashboard.\n\nAdd a widget to a SOAR dashboard\n--------------------------------\n\n1. Go to **Dashboards \\& Reports \\\u003e SOAR Dashboards**\n2. Click add **Add Widget** . **Note:** If the dashboard is newly created, you can also click add in the empty dashboard.\n3. In the **Widget Settings** dialog that appears, enter a meaningful title for the new widget. This step is mandatory. The time and environment you specify when creating the dashboard applies to all widgets of that dashboard. These fields are auto-populated based on the selection in the dashboard the widgets are being added to.\n4. Choose a **Widget Width**.\n5. Select the form of the data display. \n\n By default, the data display is in the form of a Pie Chart. Other forms you can select include Horizontal Bar graph, Vertical Bar graph and Table.\n6. For the chosen data display form, specify its corresponding fields in the left pane. For example: If you chose **Pie Chart** as the data display form, its corresponding fields are **Number of** , **Calculate\n field** , **Group by** , **Number of Results** , and **Order by** . For more information on the data display form and corresponding fields, refer to Data Display Forms. \n Depending on whether you choose **Cases** or **Alerts** -- the **Group By** options will display differently.\n7. In the **Filters** pane, select the required filters for the data you want to display. If the filter you want is not in the provided top 15 list, then you can search for it and add it in.\n8. Click **Save** . The new widget with the specified data form, parameters and filters, is added to the dashboard. \n [](/static/chronicle/images/soar/addwidgets.png)\n\n### Data display forms and fields\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
