Adding Charts/Data Visualization to a Job Report

To Configure Treemap Charts

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Treemap Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Treemap Chart's Title.
    2. Select a data Category for the Treemap Chart to display.
    3. From Scale color by, select a Job Action result for the Treemap Chart to display.
      The color saturation of each rectangle depends on the number of Job Action results that match your selection. Less saturated rectangles represent fewer matching Job Action results, while more saturated rectangles represent higher numbers of matching Job Action results.
      Selecting Passed, Detected, Prevented, or Alerted will display data in various shades of green. Selecting Failed, Not Detected, Not Prevented, Not Alerted, or Missed will display data in various shades of red.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.
Treemap Charts display data in rectangles, where rectangle size is determined by the number of Job Actions in the Data Source that match the Category and Scale color by selections you make. The greater the number of Job Actions that match, the larger the rectangle will be in size.
Hover your cursor over each rectangle to see the exact number of Job Actions that matched the Treemap settings you configured in the Details and Data Filter tabs.

A Treemap Chart configured to display alerted Job Action Results, organized by MITRE ATT&CK Tactics.

Note that the Initial Access box in is large and shaded light green. This indicates that while Initial Access was used in more Job Actions than any other Tactic, it rarely resulted in an alert being generated.

To Configure Single Stats

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Single Stat to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Single Stat's Title.
    2. Select the display style, either Text only or With guage/donut.
    3. From Value Type, select the stat you want to display.
    4. Select whether to include a percentage that represents the Single Stat.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

Four Single Stats that display percentages of Actions that were prevented, detected, alerted, and missed

To Configure a Spiral Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Spiral Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Spiral Chart's Title.
    2. Select a Value Type.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Spiral Chart showing total counts of Actions that were prevented, detected, alerted, and missed

To Configure an Overview Card

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add an Overview Card to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Overview Card's Title.
    2. Optional: Enable Show Job Stats, which displays both the number of Actions and Job Actions in your environment.
    3. For Chart Type, select whether you want to include a chart (Stacked Bar, Job Action Results Line, Trending Threshold) or not (No Visualization).
      If you choose to include a chart in your Overview Card, you'll need to configure that chart. In that case, review the configuration steps for the Stacked Bar Chart, Job Action Results Line Chart, and Trending Threshold Chart.
    4. Select whether to include any or all Single Stat values.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

An Overview Card set to display all available Single Stats together

To Configure a Pie/Donut Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Pie/Donut Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Pie/Donut Chart's Title.
    2. Select whether the chart displays as a Pie Chart or Donut Chart.
    3. Select a Value Type.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Three Column Container with three Pie/Donut Charts inside

To Configure a Stacked Bar Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Stacked Bar Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Stacked Bar Chart's Title.
    2. Select the X Axis Type, which determines whether the X axis displays results over time or results grouped by categories.

      To select the security technologies you want to exclude/include in the report:

      1. Select Security Technologies in the X Axis Type drop-down list.
      2. Deselect/Select the check box next to each security technology you want to exclude from or include in the rendered report (all known security technologies are selected by default in the list).
      3. Search for a specific security technology by entering it in the search field.
      4. Deselect or select all security technologies by clicking the Deselect All/Select All link.
      5. Click Apply.
    3. Select a Value Type, which determines what data is shown in the chart.
    4. Select whether to include a line that shows the total number of Job Actions represented in each bar in the chart.
    5. Select the Chart column density, which allows you to choose how much time is represented by each bar. The drop-down includes the following options:
      1. Automatic (this is the default but it allows for 1 hour bars when the number of days is less than 7)
      2. 1 hour
      3. 1 day
      4. 1 week
      5. 1 month
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Stacked Bar Chart that shows Pass/Fail results over time and includes total counts with a line

To Configure a Trending Threshold Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Trending Threshold Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Trending Threshold Chart's Title.
    2. Define the Desired Rate (Percentage) and the Value Type.
      The desired percentage rate determines the threshold that needs to be met for the chart to display positive or negative trends. For example, if the desired rate is set to 95 and the value type is set to Pass/Fail, the chart displays time ranges where 95% or more of Job Actions passed as green and above the threshold line. The time ranges where less than 95% of Job Actions passed will display as red and below the threshold line. In this example, the threshold line is at 95% on the Y axis.

      Annotated Data Table that includes errored Job Action data
    3. Select the Chart column density, which allows you to choose how much time is represented by each bar. The drop-down includes the following options:
      1. Automatic (this is the default but it allows for 1 hour bars when the number of days is less than 7)
      2. 1 hour
      3. 1 day
      4. 1 week
      5. 1 month
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Trending Threshold Chart where the desired percentage rate (95%) was met in June, but not in July

To Configure a Job Actions Line Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Job Actions Line Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Job Actions Line Chart's Title.
    2. Select whether the chart displays counts of or percent of total Job Actions run.
    3. Select whether the chart also displays total Job Actions run in a line and on the the Y axis.
    4. Select the Chart column density, which allows you to choose how much time is represented by each bar. The drop-down includes the following options:
      1. Automatic (this is the default but it allows for 1 hour bars when the number of days is less than 7)
      2. 1 hour
      3. 1 day
      4. 1 week
      5. 1 month
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Job Action Results Line Chart that includes the totals line and axis

To Configure a Threshold Radar Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Threshold Radar Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Threshold Radar Chart's Title.
    2. Select whether the the chart pulls Job Action results in relation to Stages of Attack, MITRE ATT&CK Tactics, NIST 800-53 Control Families, or Attacker Behaviors.
    3. Select whether the chart shows data for Pass/Fail or Prevented/Not Prevented rates.
    4. Set the threshold, or Desired Rate (Percentage), to measure your Job Action performance against. The percentage you define will appear in the chart as a dashed line.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Threshold Radar Chart that shows Pass/Fail performance organized by MITRE ATT&CK Tactics, with a 50% passing threshold set

To Configure a bullet Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Bullet Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Bullet Chart's Title.
    2. Select whether the the chart pulls Job Action results in relation to Stages of Attack, Attacker Behaviors, Attack Vector, or Zones.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Bullet Chart showing the amount of Job Actions at various Stages of Attack

To Configure a Force Field Chart

  1. In the Analyze > Reports page, create a new report or use the Actions menu to edit an existing report.
  2. Click Add Component +.
    If there are components already in the report, you may need to hover the cursor above or below a component to see this option.
  3. In the Panel Library, add a Force Field Chart to your report.

    The Edit Widget window appears.

  4. Configure the Details tab.
    1. Optional: Enter the Force Field Chart's Title.
    2. Select whether the the chart pulls Job Action results in relation to Stages of Attack, Attacker Behaviors, Attack Vector, or Zones.
    3. Select whether the chart shows data for Pass/Fail or Prevented/Not Prevented rates.
    4. Set the Result Display Style to Count or Percentage.
  5. Optional: Configure the Data Filter tab.
    See Configuring the Report Data Source for more information.
  6. Click Apply.

A Force Field Chart showing the percentage of Job Actions Prevented/Not Prevented at various Stages of Attack.

© Copyright Mandiant. All rights reserved
  • First Published: May 20, 2022
  • Last updated: December 1, 2025
In This Article
Related Articles
  • None
Copyright © 2020 – 2021 Your Company, LLC. All rights reserved.