Dashboard Management
Dashboard Management tests your ability to turn searches and offense data into a shared operational view in QRadar without degrading performance or leaking data. The exam focuses on widget design, dashboard scope, permissions, and refresh behavior.
Dashboard concepts
A dashboard is a collection of widgets. Widgets can display saved searches, offense lists, asset or vulnerability data, flow and event trends, and text. Each widget has its own query, time range, chart type, and refresh settings. Dashboards can be personal or shared and global; administrators manage global dashboards and permissions, while users can set a default dashboard.
Design rules
- Build widgets from saved searches so logic is reusable and auditable.
- Choose the visualization for the question: table for detail, bar or line for comparison and trend, single value for a KPI, text for shift notes.
- Set a deliberate time range and refresh interval; short refresh on wide ranges is expensive.
- Limit widget count; a dashboard is a summary, not a raw event browser.
- Use drill-down to the underlying search for investigation.
- Share with the right user group and verify who can view or edit.
Worked example: A SOC wants a shift dashboard. Widgets: open offenses by magnitude (table), top source IPs for authentication failures (bar), failure trend over 24 hours (line), threat-intel hits (table), and a text widget with handoff notes. Each uses a saved search, a fixed 24-hour range, and a 5-minute refresh; the dashboard is shared globally. Reasoning: the layout answers what needs attention now without duplicating raw searches; saved searches keep it maintainable.
Traps
- Creating a personal dashboard when the team needs a shared or global one.
- Forgetting that widget time ranges override expectations.
- Overloading with many widgets and slowing the console.
- Ignoring permissions and exposing sensitive data.
- Building ad hoc queries instead of saved searches.