Native Dashboards overview

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This document explains how to use the Native Dashboards feature of Google Security Operations to build visualizations over different data sources. It's composed of different charts, which are populated using YARA-L 2.0 properties.

Before you begin

Ensure that your Google SecOps instance has the following enabled:

• Before using Native Dashboards, we recommend that you ensure you have the correct Identity and Access Management (IAM) roles and configurations in place to view and interact with dashboard data effectively.

• Configure a Google Cloud project or migrate your Google SecOps instance to an existing cloud project.

• Configure a Google Cloud Identity provider or third-party identity provider.

• Configure feature access control using IAM.

IAM permissions required

The following permissions are required to access Native Dashboards:

IAM permission	Purpose
chronicle.nativeDashboards.list	View the list of all Native Dashboards.
chronicle.nativeDashboards.get	View a Native Dashboard, apply a dashboard filter, and apply the global filter.
chronicle.nativeDashboards.create	Create a new Native Dashboard.
chronicle.nativeDashboards.duplicate	Make a copy of an existing dashboard.
chronicle.nativeDashboards.update	Add and edit charts, add a filter, change dashboard access, and manage the global time filter.
chronicle.nativeDashboards.delete	Delete a Native Dashboard.

Understand Native Dashboards

Native Dashboards provide insights into security events, detections, and related data. This section outlines the supported data sources and explains how role-based access control (RBAC) affects visibility and data access within the dashboards.

Data sources supported

Native Dashboards include the following data sources, each with its corresponding YARA-L prefix:

Data source	Query time interval	YARA-L prefix	Schema
Events	90 days	no prefix	Fields
Entity graph	365 days	graph	Fields
Ingestion metrics	365 days	ingestion	Fields
Rule sets	365 days	ruleset	Fields
Detections	365 days	detection	Fields
IOCs	365 days	ioc	Fields

Impact of data RBAC

Data role-based access control (RBAC) is a security model that uses individual user roles to restrict user access to data within an organization. Data RBAC lets administrators define scopes and assign them to users, ensuring access is limited to only the data necessary for their job functions. All queries in Native Dashboards follow data RBAC rules. For more information about access controls and scopes, see Access controls and scopes in data RBAC.

Detections and analysis

Effective threat detection depends on analyzing events, entity relationships, and IOC matches. This section describes how detections work, how entity graphs aid investigations, and how rulesets improve detection.

Events, entity graph, and IOC matches

The data returned from these sources is restricted to the user's assigned access scopes, ensuring that they only see results from authorized data. If a user has multiple scopes, queries include data from all assigned scopes. Data outside the user's accessible scopes doesn't appear in search results.

Detection and rulesets with detections

Detections are generated when incoming security data matches the criteria defined in a rule. Users can only see detections that originate from rules associated with their assigned scopes.

Advanced features and monitoring

To fine-tune detections and improve visibility, you can use advanced configurations, such as YARA-L 2.0 rules and ingestion metrics. This section explores these feature insights, helping you optimize detection efficiency and monitor data processing.

YARA-L 2.0 properties

YARA-L 2.0 has the following unique properties when used in Native Dashboards:

• Additional data sources, such as entity graph, ingestion metrics, rule sets, and detections are available in dashboards. Some of these data sources are not yet available in YARA-L rules and Unified Data Model (UDM) search.

• See YARA-L 2.0 functions for Google Security Operations Native Dashboards and aggregate functions that include statistical measures.

• The query in YARA-L 2.0 must must contain a match or an outcome section, or both.

• The events section of a YARA-L rule is implied and does not need to be declared in queries.

• The condition section of a YARA-L rule is not available for dashboards.

Ingestion metrics

Ingestion components are services or pipelines that bring logs into the platform from source log feeds. Each ingestion component collects a specific set of log fields within its own ingestion metrics schema. These metrics are only visible to global users.

Need more help? Get answers from Community members and Google SecOps professionals.