FortiSIEM Charts and Views

FortiSIEM provides a variety of charts and maps to better help you understand and analyze your incident data. You can access these charts and views from the widget dashboard settings (see Modifying widget information display) or by clicking the drop-down icon in the ANALYTICS page (see Viewing Historical Search Results).

Chart/View

Description

Display Settings

Requirements

Aggregation (Bar) View

Displays data similar to a bar chart.

Select the Aggregate Field (Column) to display and their colors. You can also reverse the color map.

At least one numeric column is required.

Aggregations (Donut) View

Displays data similar to a pie chart.

Select the Aggregate Field (Column) to display since the report may have multiple Aggregate Fields.

At least one numeric column is required.

Choropleth Map (Region Map)

A thematic map in which areas are shaded or patterned in proportion to the measurement of the statistical variable being displayed on the map.

Select the Location and Value from the drop-down lists.

At least one location column is required. Configure Google Maps API Key in ADMIN > Settings > System > UI See UI Settings.

Chord View

A graphical method of displaying the inter-relationships between data in a matrix. The data is arranged radially around a circle with the relationships between the data points typically drawn as arcs connecting the data.

Select the incident Source, Target, and Value from the drop-down lists.

At least two key columns and one numeric column are required.

Clustered Bubble Chart

You can use a bubble chart instead of a scatter chart if your data has three data series that each contain a set of values. The sizes of the bubbles are determined by the values in the third data series.

Select the Column from the drop-down list.

At least one numeric column is required.

Column Trend View

Displays positive or negative trends in the data.

None

None

Combo View

Displays an aggregate field and a line chart.

Select the Aggregate Field (Column) to display and the colors. You can also reverse the color map and set color thresholds.

One GROUP BY column and one aggregation column is required.

Geo Map (Map View)

Displays the IP addresses in a geographic map.

Public or private IP addresses with location defined in ADMIN > Settings > Discovery > Location. See Setting Location.

At least one numeric column is required.

Heat Map

Displays two event attributes and a numerical aggregate value.

Select the Heat map coordinates X and Y, and an associated Value.

At least two key columns and one numeric column are required.

Line View

Data displays as a line (Line Chart).

Select the Column to display from the drop-down list. You can choose to display the data as a Stacked Area or a Line View (non-stacked).

One GROUP BY column and one aggregation column is required.

Map View

See Geo Map.

 

 

Pivot Table View

A table of statistics that summarizes the data of a more extensive table.

Select the Key Column and Value Column from the drop-down lists.

At least two GROUP BY columns and one numeric column are required.

Sankey Diagram

A specific type of flow diagram, in which the width of the arrows is shown proportionally to the flow quantity.

Select the Source, Target, and Value from the drop-down lists.

At least two GROUP BY columns and one numeric column are required.

Scatter Plot

Plots two aggregate fields.

Select two aggregate fields, X and Y. Select the Size of the sample.

At least two numeric columns are required.

Single Line

Displays a single value.

Select the Text or Gauge view and the Column and Row. For Gauge, you can also select a color-coded Range.

At least one numeric column is required.

Sunburst Chart

Visualizes hierarchical data, depicted by concentric circles. The circle in the center represents the root node, with the hierarchy moving outward from the center.

Select the Rank1, Rank2, and Count from the drop-down lists.

Only one column can be used in one rank.

Table View

Displays data in a tabular format.

You can choose to display the bar chart (Show Bar), the event type (Show Event Type), and the count (Count). Set the colors for the bar chart or reverse the color map.

None

Tree Map

Displays columns in a Tree Map.

Select the Tree Map Ranks and the Count attributes from the drop-down lists.

Only one column can be used in one rank.