Visualize Detection Events by Tactic in Pie Chart

Display MITRE ATT&CK tactics distribution in pie chart format

This is a query example for the Detection by Tactic widget in the Summary Dashboard dashboard of the crowdstrike/siem-connector package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> result

logscale

metadata.eventType=DetectionSummaryEvent
| groupby(event.Tactic)

Introduction

This widget is used to create a pie chart visualization showing the distribution of MITRE ATT&CK tactics across detection events, providing a proportional view of different attack tactics observed in the environment.

In this widget, the groupBy() function is used to aggregate detection events by tactic, generating data that will be displayed as segments in a pie chart. Each segment's size represents the relative frequency of that tactic.

Example incoming data might look like this:

@timestamp	#repo	#type	@id	@ingesttimestamp	@rawstring	@timezone	event.ComputerName	event.DetectDescription	event.DetectName	event.LocalIP	event.Objective	event.SensorId	event.SeverityName	event.Tactic	event.Technique	event.UserName	metadata.customerIDString	metadata.eventCreationTime	metadata.eventType
2026-01-12T10:22:45	auto-dashboard-queries	siem-connector	QTsJCoPniAANCCdKBxWdooCq_3_300_1768213365	2026-01-12T10:22:45	{"metadata":{ "eventType":"DetectionSummaryEvent","eventCreationTime":"1768213365060", "customerIDString":"a1b2c3d4e5f6g7h8i9j0" }, "event":{"SeverityName":"Medium", "DetectName":"Suspicious PowerShell Command Line","ComputerName":"PROD-WEB01","UserName":"adamsb","SensorId":"b2c3d4e5f6g7h8i9j0k1","LocalIP":"192.168.2.143","Tactic":"Execution","Technique":"T1059.001 - PowerShell","DetectDescription":"Detected suspicious PowerShell command execution with encoded arguments","Objective":"Command and Control"}} 86beba81b4553c59c7a125eea1100bca	Z	PROD-WEB01	Detected suspicious PowerShell command execution with encoded arguments	Suspicious PowerShell Command Line	192.168.2.143	Command and Control	b2c3d4e5f6g7h8i9j0k1	Medium	Execution	T1059.001 - PowerShell	adamsb	a1b2c3d4e5f6g7h8i9j0	1768213365060	DetectionSummaryEvent
2026-01-12T10:22:45	auto-dashboard-queries	siem-connector	QTsJCoPniAANCCdKBxWdooCq_3_301_1768213365	2026-01-12T10:22:46	{"metadata":{ "eventType":"DetectionSummaryEvent","eventCreationTime":"1768213365928", "customerIDString":"c3d4e5f6g7h8i9j0k1l2" }, "event":{"SeverityName":"Low", "DetectName":"Suspicious Registry Modification","ComputerName":"PROD-APP02","UserName":"andersonk","SensorId":"d4e5f6g7h8i9j0k1l2m3","LocalIP":"192.168.0.87","Tactic":"Credential Access","Technique":"T1003.001 - LSASS Memory","DetectDescription":"Detected potential credential dumping from LSASS memory","Objective":"Credential Theft"}} 86beba81b4553c59c7a125eea1100bca	Z	PROD-APP02	Detected potential credential dumping from LSASS memory	Suspicious Registry Modification	192.168.0.87	Credential Theft	d4e5f6g7h8i9j0k1l2m3	Low	Credential Access	T1003.001 - LSASS Memory	andersonk	c3d4e5f6g7h8i9j0k1l2	1768213365928	DetectionSummaryEvent
2026-01-12T10:22:46	auto-dashboard-queries	siem-connector	QTsJCoPniAANCCdKBxWdooCq_3_302_1768213366	2026-01-12T10:22:47	{"metadata":{ "eventType":"DetectionSummaryEvent","eventCreationTime":"1768213366748", "customerIDString":"e5f6g7h8i9j0k1l2m3n4" }, "event":{"SeverityName":"High", "DetectName":"Credential Dumping via Mimikatz","ComputerName":"PROD-DB01","UserName":"bakerm","SensorId":"f6g7h8i9j0k1l2m3n4o5","LocalIP":"192.168.3.211","Tactic":"Lateral Movement","Technique":"T1021.002 - SMB/Windows Admin Shares","DetectDescription":"Detected suspicious access to administrative shares","Objective":"Internal Reconnaissance"}} 86beba81b4553c59c7a125eea1100bca	Z	PROD-DB01	Detected suspicious access to administrative shares	Credential Dumping via Mimikatz	192.168.3.211	Internal Reconnaissance	f6g7h8i9j0k1l2m3n4o5	High	Lateral Movement	T1021.002 - SMB/Windows Admin Shares	bakerm	e5f6g7h8i9j0k1l2m3n4	1768213366748	DetectionSummaryEvent
2026-01-12T10:22:47	auto-dashboard-queries	siem-connector	QTsJCoPniAANCCdKBxWdooCq_3_303_1768213367	2026-01-12T10:22:48	{"metadata":{ "eventType":"DetectionSummaryEvent","eventCreationTime":"1768213367566", "customerIDString":"g7h8i9j0k1l2m3n4o5p6" }, "event":{"SeverityName":"Critical", "DetectName":"Suspicious Service Creation","ComputerName":"PROD-FILE01","UserName":"blackj","SensorId":"h8i9j0k1l2m3n4o5p6q7","LocalIP":"192.168.1.54","Tactic":"Defense Evasion","Technique":"T1078.002 - Domain Accounts","DetectDescription":"Detected authentication using potentially compromised domain account","Objective":"Privilege Escalation"}} 86beba81b4553c59c7a125eea1100bca	Z	PROD-FILE01	Detected authentication using potentially compromised domain account	Suspicious Service Creation	192.168.1.54	Privilege Escalation	h8i9j0k1l2m3n4o5p6q7	Critical	Defense Evasion	T1078.002 - Domain Accounts	blackj	g7h8i9j0k1l2m3n4o5p6	1768213367566	DetectionSummaryEvent
2026-01-12T10:22:48	auto-dashboard-queries	siem-connector	QTsJCoPniAANCCdKBxWdooCq_3_304_1768213368	2026-01-12T10:22:49	{"metadata":{ "eventType":"DetectionSummaryEvent","eventCreationTime":"1768213368386", "customerIDString":"i9j0k1l2m3n4o5p6q7r8" }, "event":{"SeverityName":"Medium", "DetectName":"Lateral Movement via WMI","ComputerName":"PROD-SQL01","UserName":"brownr","SensorId":"j0k1l2m3n4o5p6q7r8s9","LocalIP":"192.168.4.198","Tactic":"Persistence","Technique":"T1053.005 - Scheduled Task","DetectDescription":"Detected suspicious scheduled task creation for persistence","Objective":"Persistence Establishment"}} 86beba81b4553c59c7a125eea1100bca	Z	PROD-SQL01	Detected suspicious scheduled task creation for persistence	Lateral Movement via WMI	192.168.4.198	Persistence Establishment	j0k1l2m3n4o5p6q7r8s9	Medium	Persistence	T1053.005 - Scheduled Task	brownr	i9j0k1l2m3n4o5p6q7r8	1768213368386	DetectionSummaryEvent

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
metadata.eventType=DetectionSummaryEvent
```
Filters the events to include only those where metadata.eventType equals DetectionSummaryEvent, focusing the analysis on detection summary events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1[/Filter/] 2{{Aggregate}} result{{Result Set}} repo --> 1 1 --> 2 2 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| groupby(event.Tactic)
```
Groups events by unique values in event.Tactic, counts occurrences of each tactic to determine segment sizes, and returns the results with count for each tactic for pie chart visualization.
Event Result set.

Summary and Results

The widget is used to display a pie chart showing the proportional distribution of MITRE ATT&CK tactics in detection events.

This widget is useful to understand the predominant attack tactics being used, identify tactical patterns, and visualize the relative frequency of different attack approaches.

Sample output from the incoming example data:

_count	event.Tactic
21	Credential Access
26	Defense Evasion
27	Execution
13	Lateral Movement
13	Persistence

The output data is visualized as a pie chart where each tactic is represented by a segment, with the size proportional to the count value.

The distribution shows varying frequencies across different tactics, with Execution, Defense Evasion, and Credential Access being the most prevalent.

Versions of this Page

Examples Library