obsidiansecurity/actionnotification Dashboards

Obsidian Security Overview

The Obsidian Security Overview dashboard provides comprehensive security monitoring and threat analysis through integrated real-time visualizations. This dashboard enables tracking of security alerts across services, analysis of MITRE ATT&CK patterns, and monitoring of severity distributions across the environment.
Obsidian Security Posture Management

The Obsidian Security Posture Management dashboard presents detailed compliance and security posture metrics through multi-dimensional visualizations. This dashboard enables monitoring of compliance drift patterns, tracking of security transitions, and assessment of compliance status across different domains.
Obsidian Security Threat Management

The Obsidian Security Threat Management dashboard provides incident analysis and threat monitoring through service-oriented visualizations. This dashboard enables tracking of security incidents by service, assessment of threat severity levels, and investigation of incident workflows across the security landscape.

Obsidian Security Overview

The Obsidian Security Overview dashboard provides comprehensive security monitoring and threat analysis through integrated real-time visualizations. This dashboard enables tracking of security alerts across services, analysis of MITRE ATT&CK patterns, and monitoring of severity distributions across the environment.

Widget	Description	Type
Most recent alert timestamp	Displays the timestamp of the most recent system alert. Hide Query Show Query logscale `\| tail(1) \| time := formatTime("%Y/%m/%d %H:%M:%S.%L", field=@timestamp, locale=en_US, timezone=Z) \| select(time)`	`Single Value`
Alerts today (vs yesterday)	Displays the number of Obsidian security alerts in a 1 day timespan. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| timeChart(span=1d)`	`Single Value`
MITRE ATT&CK - by count	Displays a list of MITRE ATT&CK occurrences by tactic, technique, and number detected. Hide Query Show Query logscale #Vendor="obsidiansecurity" \| Vendor.intelligenceCatalogReference.taxonomy.technique.name=* Vendor.intelligenceCatalogReference.taxonomy.technique.name!="" \| groupBy(field=[Vendor.intelligenceCatalogReference.taxonomy.tactic.name,Vendor.intelligenceCatalogReference.taxonomy.technique.name]) \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.tactic.name, as="Tactic") \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.technique.name, as="Technique") \| rename(field=_count, as="Number Detected")	`Heat Map`
Alerts by service timechart	Displays a time chart of Obsidian Security service alerts. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| timechart(Vendor.service.name)`	`Time Chart`
Alerts by severity	Displays a pie chart of Obsidian alerts by severity. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| groupBy(Vendor.severity)`	`Pie Chart`
MITRE ATT&CK by total risk	Displays a heat map of MITRE ATT&CK data by total risk score using event risk score data. Hide Query Show Query logscale #Vendor="obsidiansecurity" \| Vendor.intelligenceCatalogReference.taxonomy.technique.name=* Vendor.intelligenceCatalogReference.taxonomy.technique.name!="" event.risk_score=* \| groupBy(field=[Vendor.intelligenceCatalogReference.taxonomy.tactic.name,Vendor.intelligenceCatalogReference.taxonomy.technique.name, severity_value]) \| total_risk := event.risk_score * _count \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.tactic.name, as="Tactic") \| rename(field=Vendor.intelligenceCatalogReference.taxonomy.technique.name, as="Technique") \| rename(field=total_risk, as="Total Risk") \| drop([event.risk_score, _count])	`Heat Map`
Most recent alert timestamp by service	Displays a table of the most recent alert timestamp organized by service, using Obsidian Security data. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.service.name=* \| groupBy([Vendor.service.name], function=selectLast([Vendor.eventDatetime]))`	`Table`
Alerts by severity timechart	Displays a chart of Obsidian Security alerts by severity. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| timechart(Vendor.severity)`	`Time Chart`

Obsidian Security Posture Management

The Obsidian Security Posture Management dashboard presents detailed compliance and security posture metrics through multi-dimensional visualizations. This dashboard enables monitoring of compliance drift patterns, tracking of security transitions, and assessment of compliance status across different domains.

Widget	Description	Type
Compliance Drift Alert	Displays a table of compliance drift alerts. Hide Query Show Query logscale `Vendor.type="POSTURE" \| select(fields=[Vendor.severity,Vendor.summary])`	`Table`
Compliance by Transition	Displays a table of a user's compliance posture by transition. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.transition)`	`Table`
Compliance By Domain	Displays a pie chart of compliance status by domain. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.domains[0])`	`Pie Chart`
Compliance by Severity	Displays a pie chart of compliance posture by severity. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.severity)`	`Pie Chart`
Compliance by Name	Displays a pie chart of compliance posture by vendor name. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.name)`	`Pie Chart`
Compliance by Status	Displays a list of vendors and their compliance status. Hide Query Show Query logscale `Vendor.type="POSTURE" \| groupBy(Vendor.accepted)`	`Pie Chart`

Obsidian Security Threat Management

The Obsidian Security Threat Management dashboard provides incident analysis and threat monitoring through service-oriented visualizations. This dashboard enables tracking of security incidents by service, assessment of threat severity levels, and investigation of incident workflows across the security landscape.

Widget	Description	Type
Incident by Service	Displays a pie chart of Obsidian security incidents by service name. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| groupBy(Vendor.service.name)`	`Pie Chart`
Incident by Severity	Displays a pie chart of Obsidian security incidents by severity.s Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| groupBy(Vendor.severity)`	`Pie Chart`
Incident Summary	Displays a table of Obsidian Security event summary data including event date and time, workflow status, event risk score, etc. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| table(fields=[Vendor.severity, Vendor.eventDatetime, Vendor.service.name, Vendor.relatedActorEmails[0], Vendor.name, Vendor.workflowProperties.status, event.risk_score ]) \| sort(event.risk_score) \| drop(event.risk_score)`	`Table`
Incident Status	Displays a pie chart of Obsidian Security incident threat statuses. Hide Query Show Query logscale `#Vendor="obsidiansecurity" \| Vendor.type="THREAT" \| groupBy(Vendor.workflowProperties.status)`	`Pie Chart`

Versions of this Page

Package Marketplace

Package Reference

Dashboard Reference

Package Management

Other Integrations

Log Formats

obsidiansecurity/actionnotification Dashboards

Obsidian Security Overview

Obsidian Security Posture Management

Obsidian Security Threat Management

Enter search term