Threat Type Distribution

Visualize threat types (malware, ransomware, phishing) distribution within each time period. Useful for monitoring how the different threats evolve over time, for tracking thread volumes and visualize different threat types comparison.

Bar Chart type: multiple series, stacked bars.

Sample input data:

hostseveritythreat_typetimestamp
host1HighMalware2025-08-11T00:01:23Z
host2CriticalRansomware2025-08-11T00:01:24Z
host3MediumPhishing2025-08-11T00:01:25Z
host4HighMalware2025-08-11T00:01:26Z
host5CriticalRansomware2025-08-11T00:01:27Z

Query:

logscale
threat_type=*
| timeBucket:=formatTime("%Y-%m-%d", field=@timestamp)
| groupBy([timeBucket, threat_type], limit=max)

Query breakdown:

  1. Filter for threat events

  2. Convert timestamp into daily buckets

  3. Group by time bucket and threat type

You can change the format in the formatTime() function for alternative bucket formats (hourly, weekly, monthly buckets).

Visualization: a stacked bar chart with each threat type (malware, ransomware, phishing) as a separate series over time.

Bar Chart showing use case of Threat Type Distribution

Figure 209. Threat Type Distribution


Configuration:

  1. From the Search page, type your query in the Query Editor → click Run

  2. Choose Bar Chart in the Widget selector

  3. Click the style icon : the side panel shows most settings already configured by default based on the query result. You may configure more settings manually, as follows.

  4. In Layout, select Stacked as the type.

  5. Check Show title for both Category axis and Value axis (left)

  6. Toggle the Legend on, set the position of the legend to the right.

  7. In Colors, choose a custom palette instead of that inherited from the dashboard.

You can further customize this widget by setting more properties, see Bar Chart Property Reference.