obsidiansecurity/actionnotification Dashboards | Integrations | LogScale Documentation

Skip to content

LogScale Documentation Full Library Knowledge Base Release Notes Integrations Query Examples Training API GraphQL API Contacting Support

Reading time: 2 minutes

obsidiansecurity/actionnotification Dashboards

Obsidian Security Overview

Widget	Description	Type
Most recent alert timestamp	Displays the timestamp of the most recent system alert. Hide Query Show Query logscale `\| tail(1) \| time := formatTime("%Y/%m/%d %H:%M:%S.%L", field=@timestamp, locale=en_US, timezone=Z) \| select(time)`	`Single Value`
Alerts today (vs yesterday)	Displays the number of Obsidian security alerts in a 1 day timespan. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| timeChart(span=1d)`	`Single Value`
MITRE ATT&CK - by count	Displays a list of MITRE ATT@CK occurrences by tactic, technique, and number detected. Hide Query Show Query logscale #Vendor="obsidiansecurity" \| Vendor.intelligenceCatalogReference.taxonomy.technique.name=* Vendor.intelligenceCatalogReference.taxonomy.technique.name!="" \| groupBy(field=[Vendor.intelligenceCatalogReference.taxonomy.tactic.name,Vendor.intelligenceCatalogReference.taxonomy.technique.name]) \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.tactic.name, as="Tactic") \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.technique.name, as="Technique") \| rename(field=_count, as="Number Detected")	`Heat Map`
Alerts by service timechart	Displays a time chart of Obsidian Security service alerts. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| timechart(Vendor.service.name)`	`Time Chart`
Alerts by severity	Displays a pie chart of Obsidian alerts by severity. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| groupBy(Vendor.severity)`	`Pie Chart`
MITRE ATT&CK by total risk	Displays a heat map of MITRE ATT@CK data by total risk score using event risk score data. Hide Query Show Query logscale #Vendor="obsidiansecurity" \| Vendor.intelligenceCatalogReference.taxonomy.technique.name=* Vendor.intelligenceCatalogReference.taxonomy.technique.name!="" event.risk_score=* \| groupBy(field=[Vendor.intelligenceCatalogReference.taxonomy.tactic.name,Vendor.intelligenceCatalogReference.taxonomy.technique.name, severity_value]) \| total_risk := event.risk_score * _count \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.tactic.name, as="Tactic") \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.technique.name, as="Technique") \| rename(field=total_risk, as="Total Risk") \| drop([event.risk_score, _count])	`Heat Map`
Most recent alert timestamp by service	Displays a table of the most recent alert timestamp organized by service, using Obsidian Security data. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.service.name=* \| groupBy([Vendor.service.name], function=selectLast([Vendor.eventDatetime]))`	`Table`
Alerts by severity timechart	Displays a chart of Obsidian Security alerts by severity. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| timechart(Vendor.severity)`	`Time Chart`

Obsidian Security Posture Management

Widget	Description	Type
Compliance Drift Alert	Displays a table of compliance drift alerts. Hide Query Show Query logscale `Vendor.type="POSTURE" \| select(fields=[Vendor.severity,Vendor.summary])`	`Table`
Compliance by Transition	Displays a table of a user's compliance posture by transition. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.transition)`	`Table`
Compliance By Domain	Displays a pie chart of compliance status by domain. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.domains[0])`	`Pie Chart`
Compliance by Severity	Displays a pie chart of compliance posture by severity. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.severity)`	`Pie Chart`
Compliance by Name	Displays a pie chart of compliance posture by vendor name. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.name)`	`Pie Chart`
Compliance by Status	Displays a list of vendors and their compliance status. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.accepted)`	`Pie Chart`

Obsidian Security Threat Management

Widget	Description	Type
Incident by Service	Displays a pie chart of Obsidian security incidents by service name. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| groupBy(Vendor.service.name)`	`Pie Chart`
Incident by Severity	Displays a pie chart of Obsidian security incidents by severity.s Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| groupBy(Vendor.severity)`	`Pie Chart`
Incident Summary	Displays a table of Obsidian Security event summary data including event date and time, workflow status, event risk score, etc. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| table(fields=[Vendor.severity, Vendor.eventDatetime, Vendor.service.name, Vendor.relatedActorEmails[0], Vendor.name, Vendor.workflowProperties.status, event.risk_score ]) \| sort(event.risk_score) \| drop(event.risk_score)`	`Table`
Incident Status	Displays a pie chart of Obsidian Security incident threat statuses. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| groupBy(Vendor.workflowProperties.status)`	`Pie Chart`

Enter search term