Dashboards

Dashboards provide a grid of widgets, each running an independent BQL query. Use them to build monitoring views scoped to a fractal or prism.

Creating a Dashboard

Navigate to Dashboards within a fractal or prism. Click Create and provide a name and optional description.

Widgets

Each widget is a self-contained panel with:

• Title - descriptive label
• Query - a BQL query. The visualization is chosen by the query's final command, so | piechart(), | timechart(...), | mesh(...) and so on each render as that chart; a query with no visualization command renders as a table
• Layout - position and size on the 12-column grid (drag to rearrange and resize)

Available chart types are table, piechart, barchart, timechart, singleval, histogram, heatmap, graph, mesh, pgraph, and worldmap. See Visualizations.

Widget results are cached so the dashboard loads quickly on return visits.

Time Range & Auto-Refresh

A dashboard-level time range applies to all widgets. Options include preset ranges (1h, 24h, 7d, 30d) or a custom start/end.

A dashboard can also be set to refresh on an interval, which re-executes its widgets in the background so a wallboard stays current without anyone reloading the page.

Pivots & Drilldowns

A widget can be configured so clicking a table cell, chart segment, or data point passes that row through to another dashboard or to a search. This turns a summary dashboard into an investigation entry point without duplicating queries.

Shared Links

A dashboard can be published as a read-only link that needs no login, for wallboards and status screens. Shared links serve cached results only and never execute BQL, so an exposed link cannot be used to run queries against your logs. The feature is off by default globally and must be enabled by an admin before any link can be created; individual links can be revoked at any time.

Real-Time Collaboration

Dashboards and notebooks stream updates over SSE, so edits by one user appear for everyone viewing the same document, along with presence indicators showing who else is on it.

Variables

Dashboard variables let you parameterize queries across widgets. Define name-value pairs, then reference them in widget queries. Changing a variable value re-runs all affected widgets.

Export & Import

Dashboards can be exported as YAML and re-imported into the same or a different fractal. This is useful for sharing standard monitoring layouts across teams.

Access Control

• Viewer - can view dashboards
• Analyst - can create, edit, and delete dashboards and widgets

Notebooks

Notebooks combine markdown documentation and executable BQL queries in a single ordered document. They are useful for incident investigations, runbooks, and collaborative analysis.

Creating a Notebook

Navigate to Notebooks within a fractal or prism. Click Create and provide a name and optional description.

Sections

Notebooks contain the following section types:

• Markdown - formatted text for documentation, notes, and context
• Query - a BQL query that can be executed and re-run. Results are cached with the section and can be displayed as a chart
• AI Summary - an auto-generated summary of all other sections in the notebook (requires AI to be configured). Each notebook can have at most one AI Summary section
• AI Attack Chain Summary - a structured analysis that maps notebook findings to MITRE ATT&CK tactics. The executive summary is shown by default; each tactic is a collapsible section with findings that link back to the relevant comment. Available when generating a notebook from comments with the "AI Attack Chain Summary" checkbox enabled
• Comment Context - auto-generated when creating a notebook from comments. Shows the comment text, author, associated query, and matching log for each comment

Sections can be reordered by dragging.

Time Range

A notebook-level time range applies to all query sections. This ensures consistent results across an investigation.

Variables

Like dashboards, notebooks support variables that can be referenced in query sections.

Export & Import

Notebooks export as YAML for sharing and version control.