SOC › Module 5 › Lesson 2
Dashboards Named
Dashboard literacy names KPI panels, hunt progress boards, and detection health views — design on YOUR $HUNT_LAB metrics on paper without stranger Kibana login.
Visual · t30_dashboards_named
Dashboard literacy. $HUNT_LAB only. Original Cyberlium.
Opening
Dashboards tell leadership and L2 what matters — literacy names panel types before you build on production tenants.
SOC dashboards show: alert volume trends, MTTR, hunt campaign status, detection coverage by ATT&CK tactic, top noisy rules, ingest health. L2 contributes hunt findings panels and correlation summaries — design as paper wireframe mapped to $HUNT_LAB fictional metrics. Cyberlium names dashboard panels on YOUR $HUNT_LAB — counts from jq on jsonl for fake KPIs; never screenshot stranger employer dashboards with customer names. Next: Tuning L2.
1. Dashboard panel types (named)
Trend: alert volume over time on lab fictional queue. Table: top 10 src_ip failed auth from jq count. Coverage: ATT&CK tactics with/without rules — literacy map. Health: jsonl ingest lag fictional metric.
On $HUNT_LAB, wireframe four panels for one L2 hunt dashboard on paper.
Command guide
Try these commands — Dashboard panel types (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Splunk dashboards — https://docs.splunk.com/Documentation/Splunk/latest/Viz/DashboardExamples Elastic dashboards — https://www.elastic.co/guide/en/kibana/current/dashboard.html MITRE — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/dashboards/dashboard-checklist.md" <<'EOF'
# Dashboard Checklist (markdown — no live Splunk required)
## LAB-IR-001 hunt dashboard panels
- [ ] Failed logon timeline (auth.jsonl 4625/4624 by ts)
- [ ] Rare parent process table (process.jsonl parent→child)
- [ ] Netflow beacon chart (203.0.113.99 bytes_out over time)
- [ ] Alert status pie (HNT-001/002/003 disposition)
- [ ] MITRE technique heatmap (T1110, T1059, T1071)
## Data source
- YOUR seeded JSONL only — not production SIEM
## Build method
- Document panel specs + sample jq output in markdown
- Optional: import to Elastic/Splunk in authorized lab only
EOFCommand — copy this
grep '\[ \]' "$HUNT_LAB/dashboards/dashboard-checklist.md"
python3 -c "print('Dashboard literacy: spec panels from YOUR FAKE telemetry')"Primary tools to practice this lesson: grep, python3. Reference sites: Splunk dashboards (https://docs.splunk.com/Documentation/Splunk/latest/Viz/DashboardExamples); Elastic dashboards (https://www.elastic.co/guide/en/kibana/current/dashboard.html); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why dashboards support L2 hunts
Dashboards communicate hunt progress to L3 and detection engineering — repeatable KPIs beat ad-hoc screenshots. Good panels cite data source and refresh interval — even on lab wireframes.
Defenders restrict dashboard RBAC — students design on paper before vendor UI.
3. Literacy ≠ stranger dashboard export
Forbidden: sharing live employer Kibana dashboard with customer hostnames. Allowed: dashboard wireframe — four panels, data source, $HUNT_LAB jq metric example.
Ship: dashboard wireframe for YOUR lab hunt KPIs. Next: Tuning L2.
4. What you ship: dashboard wireframe for $HUNT_LAB
Four panels with data source and lab metric. $HUNT_LAB named. NO stranger dashboard export. chmod 600.
5. What you record before the next lesson
Date. Dashboard wireframe. $HUNT_LAB named. File t30-m05-l02-dashboards-named.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Screenshot production dashboard with PII. Wireframe panels with no data source labeled.
Right
Write dashboard wireframe for YOUR $HUNT_LAB hunt KPIs. Next: Tuning L2.
Mission: wireframe hunt dashboard on YOUR lab metrics
1) Name four panel types. 2) Cite $HUNT_LAB jsonl source per panel. 3) One jq-derived fake KPI example. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Label refresh interval even on wireframes — stale panels mislead leadership.
Knowledge Check
APPLY: L2 hunt dashboards may show:
Multiple choice
Knowledge Check
APPLY: True or False: Dashboard wireframes can use jq counts from lab jsonl as fake KPIs.
True or False
Knowledge Check
APPLY: Dashboard literacy on Cyberlium avoids:
Multiple choice