Skip to main content

Visualization

Visualization is part of how you investigate a security question. Many patterns are only obvious when visualized in a chart or graph. You can collect useful visualizations in dashboards for recurring monitoring and for finite work such as a hunt or incident, where the dashboard's usefulness may end with the work. Talking with Simba reduces the effort of creating and revising them.

Visualizations extend query work​

Visualization reveals patterns in query results that are difficult to recognize from rows alone. A baseline can shift, events can concentrate around an unusual value, and a relationship between two dimensions can appear only when you examine them together. Behavior over time can reveal a change that no individual record establishes.

Interpreting a visualization may also challenge your framing of the security question. An aggregation may combine behavior that should be examined separately, a time window may be too short to establish a baseline, or grouping by a high-cardinality field may fragment a pattern into noise. The query can be technically correct without isolating the behavior you intended to investigate.

No single visualization is canonical for a result set because the appropriate visualization depends on the security question you are asking.

Simba helps you design visualizations​

Ask Simba to visualize a security question, and the query and visualization appear in the query interface.

Visualization design translates analytical intent into decisions about fields, aggregation, visual encoding, layout, and presentation. You can express that intent to Simba in the language of the investigation: what to compare, which behavior to emphasize, or what seems misleading in the current visualization.

Simba uses your direction, together with the query and its result columns, to propose an initial design. When revising an existing visualization, Simba also considers its current design and limits the revision to the changes you request. The conversation can move between analytical and visual feedback. You can explain that a result looks compressed, that a comparison needs separation, or that an outlier deserves emphasis without first translating the request into a visualization specification.

Conversational authoring reduces the effort of producing a visualization. Just keep talking to Simba until the visualization faithfully represents your security question.

Dashboards combine visualizations that work well together​

A security question often needs several visualizations. Different measures, dimensions, populations, or time horizons can illuminate separate parts of the same behavior. A dashboard collects those visualizations into one working context.

Each visualization panel stores the query, visual design, and time range that define the visualization, preserving your framing so you can revisit it. Refreshing a dashboard updates the data shown by its visualizations. The dashboard can also develop as the work changes: you can revise one panel, add another perspective, or remove a panel that no longer contributes.

Simba can help you create entire dashboards, not just individual visualizations. Describe the collection of visualizations you need, and Simba can create the dashboard, add or revise its panels, and adjust it as the question develops.

Short-lived security work can justify a dashboard​

Dashboards are commonly treated as long-lived content for composing related visualizations used together. That said, many questions in security operations are temporary. A hunt tests a hypothesis, an investigation develops toward a verdict, and an incident eventually closes. Those workflows can still require several visualizations that develop together as the question changes, even though their usefulness may end when the work reaches its conclusion.

High authoring effort makes a dashboard difficult to justify for a short-lived question because the work of building it can exceed the value of using it once. Simba reduces that effort by helping you create and revise the queries, visualizations, and dashboard content through conversation. You can therefore use short-lived dashboards for hunts, investigations, and incidents, alongside long-lived dashboards for recurring questions.

A dashboard's useful lifetime can match the work it supports. A short-lived dashboard can disappear when the work ends, having fully served its purpose.