Automation Insights
Provides a high-level overview of the health and performance of automated processes, focusing on error rates, execution trends, and automation effectiveness
Common Dashboards ENABLED
Details
| ID | 03ffcf649a8a4cd6b9e0170b794baa89 |
|---|---|
| From Version | 6.10.0 |
Widgets (8)
Automated actions by status
Custom XQL single
dataset = playbook_tasks | filter automated = true | filter task_status != null and task_status != "" | comp count() as task_count by task_status | sort desc task_count | view graph type = single subtype = standard yaxis = task_count
Actions by verdict
Custom XQL pie
dataset = indicators | filter verdict != null and verdict != "" | comp count() as action_count by verdict | sort desc action_count | view graph type = pie xaxis = verdict yaxis = action_count legend_percentage = `true`
Automated vs manual actions
Custom XQL pie
dataset = scripts_and_commands_metrics | alter action_type = if(is_manual = true, "Manual", "Automated") | comp count() as action_count by action_type | sort desc action_count | view graph type = pie xaxis = action_type yaxis = action_count legend_percentage = `true`
Incidents closed over time
Custom XQL line
dataset = incidents | filter resolved_ts != null | bin resolved_ts span = 1d | comp count() as closed_count by resolved_ts | sort asc resolved_ts | view graph type = line xaxis = resolved_ts yaxis = closed_count
Indicator activity by type
Custom XQL line
dataset = indicators | filter type != null and type != "" | bin _time span = 1d | comp count() as indicator_count by _time, type | view graph type = line xaxis = _time yaxis = indicator_count series = type
Command executions per integration category
Custom XQL column
dataset = scripts_and_commands_metrics | filter type = "integration" | filter category != null and category != "" | comp count() as exec_count by category | sort desc exec_count | view graph type = column subtype = grouped xaxis = category yaxis = exec_count
Malicious indicators observed
Custom XQL pie
dataset = indicators | filter verdict = "Malicious" | filter type != null and type != "" | comp count() as indicator_count by type | sort desc indicator_count | view graph type = pie xaxis = type yaxis = indicator_count
Average runtime per playbook (Top 5)
Custom XQL column
dataset = playbook_runs | filter playbook_status in ("completed", "failed") | filter run_time != null | comp avg(run_time) as avg_runtime_secs by playbook_name | sort desc avg_runtime_secs | limit 5 | view graph type = column subtype = grouped xaxis = playbook_name yaxis = avg_runtime_secs
{ "dashboards_data": [ { "id": "03ffcf649a8a4cd6b9e0170b794baa89", "name": "Automation Insights", "description": "Provides a high-level overview of the health and performance of automated processes, focusing on error rates, execution trends, and automation effectiveness", "status": "ENABLED", "layout": [ { "id": "row-3968", "data": [ { "key": "xql", "data": { "type": "Custom XQL", "title": "Automated actions by status", "width": 33.333333333333336, "height": 511, "phrase": "dataset = playbook_tasks\n| filter automated = true\n| filter task_status != null and task_status != \"\"\n| comp count() as task_count by task_status\n| sort desc task_count\n| view graph type = single subtype = standard yaxis = task_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "task_count" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Actions by verdict", "width": 33.333333333333336, "height": 511, "phrase": "dataset = indicators\n| filter verdict != null and verdict != \"\"\n| comp count() as action_count by verdict\n| sort desc action_count\n| view graph type = pie xaxis = verdict yaxis = action_count legend_percentage = `true` ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "verdict" } }, { "command": { "op": "=", "name": "yaxis", "value": "action_count" } }, { "command": { "op": "=", "name": "legend_percentage", "value": "`true`" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Automated vs manual actions", "width": 33.333333333333336, "height": 511, "phrase": "dataset = scripts_and_commands_metrics\n| alter action_type = if(is_manual = true, \"Manual\", \"Automated\")\n| comp count() as action_count by action_type\n| sort desc action_count\n| view graph type = pie xaxis = action_type yaxis = action_count legend_percentage = `true` ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "action_type" } }, { "command": { "op": "=", "name": "yaxis", "value": "action_count" } }, { "command": { "op": "=", "name": "legend_percentage", "value": "`true`" } } ] } } } ] }, { "id": "row-3874", "data": [ { "key": "xql", "data": { "type": "Custom XQL", "title": "Incidents closed over time", "width": 33.333333333333336, "height": 511, "phrase": "dataset = incidents \n| filter resolved_ts != null\n| bin resolved_ts span = 1d\n| comp count() as closed_count by resolved_ts\n| sort asc resolved_ts\n| view graph type = line xaxis = resolved_ts yaxis = closed_count", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "line", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "resolved_ts" } }, { "command": { "op": "=", "name": "yaxis", "value": "closed_count" } }, { "command": { "op": "=", "name": "series", "value": "alert_categories" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Indicator activity by type", "width": 33.333333333333336, "height": 511, "phrase": "dataset = indicators\n| filter type != null and type != \"\"\n| bin _time span = 1d\n| comp count() as indicator_count by _time, type\n| view graph type = line xaxis = _time yaxis = indicator_count series = type ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "line", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "_time" } }, { "command": { "op": "=", "name": "yaxis", "value": "indicator_count" } }, { "command": { "op": "=", "name": "series", "value": "type" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Command executions per integration category", "height": 511, "phrase": "dataset = scripts_and_commands_metrics\n| filter type = \"integration\"\n| filter category != null and category != \"\"\n| comp count() as exec_count by category\n| sort desc exec_count\n| view graph type = column subtype = grouped xaxis = category yaxis = exec_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "grouped" } }, { "command": { "op": "=", "name": "xaxis", "value": "category" } }, { "command": { "op": "=", "name": "yaxis", "value": "exec_count" } } ] } } } ] }, { "id": "row-4666", "data": [ { "key": "xql", "data": { "type": "Custom XQL", "title": "Malicious indicators observed", "width": 50, "height": 444, "phrase": "dataset = indicators\n| filter verdict = \"Malicious\"\n| filter type != null and type != \"\"\n| comp count() as indicator_count by type\n| sort desc indicator_count\n| view graph type = pie xaxis = type yaxis = indicator_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "type" } }, { "command": { "op": "=", "name": "yaxis", "value": "indicator_count" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Average runtime per playbook (Top 5)", "width": 50, "height": 444, "phrase": "dataset = playbook_runs\n| filter playbook_status in (\"completed\", \"failed\")\n| filter run_time != null\n| comp avg(run_time) as avg_runtime_secs by playbook_name\n| sort desc avg_runtime_secs \n| limit 5\n| view graph type = column subtype = grouped xaxis = playbook_name yaxis = avg_runtime_secs ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "grouped" } }, { "command": { "op": "=", "name": "xaxis", "value": "playbook_name" } }, { "command": { "op": "=", "name": "yaxis", "value": "avg_runtime_secs" } } ] } } } ] } ], "default_dashboard_id": 1, "global_id": "03ffcf649a8a4cd6b9e0170b794baa89", "metadata": { "params": [] } } ], "widgets_data": [], "fromVersion": "6.10.0" }