Skip to content

fix(soc-optimization-unified): make the health dashboard distinguish live from historical #1177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scottbrumley merged 1 commit into from
Sep 24, 2026
Merged

fix(soc-optimization-unified): make the health dashboard distinguish live from historical #1177

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
125 changes: 104 additions & 21 deletions Packs/soc-optimization-unified/XSIAMDashboards/SOCFW_Framework_Health.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,47 @@
{
"id": "row-1200",
"data": [
{
"key": "xql_1790000000010",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\"\n| alter failed = if(has_error = true, 1, 0)\n| comp sum(failed) as failed_last_24h\n| view graph type = single subtype = standard header = \"Failures in the Last 24h\" yaxis = failed_last_24h",
"time_frame": {
"relativeTime": 86400000
},
"viewOptions": {
"type": "single",
"commands": [
{
"command": {
"op": "=",
"name": "subtype",
"value": "standard"
}
},
{
"command": {
"op": "=",
"name": "header",
"value": "\"Failures in the Last 24h\""
}
},
{
"command": {
"op": "=",
"name": "yaxis",
"value": "failed_last_24h"
}
}
]
}
}
},
{
"key": "xql_1790000000001",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\"\n| alter failed = if(has_error = true, 1, 0)\n| comp sum(failed) as failed_commands, count() as total_commands\n| alter error_rate_pct = round(multiply(divide(failed_commands, total_commands), 100))\n| view graph type = single subtype = standard header = \"Command Error Rate (%)\" yaxis = error_rate_pct",
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\"\n| alter failed = if(has_error = true, 1, 0)\n| comp sum(failed) as failed_commands, count() as total_commands\n| alter error_rate_pct = round(multiply(divide(failed_commands, total_commands), 100))\n| view graph type = single subtype = standard header = \"Command Error Rate (%) (7d)\" yaxis = error_rate_pct",
"time_frame": {
"relativeTime": 2592000000
"relativeTime": 604800000
},
"viewOptions": {
"type": "single",
Expand All @@ -31,7 +66,7 @@
"command": {
"op": "=",
"name": "header",
"value": "\"Command Error Rate (%)\""
"value": "\"Command Error Rate (%) (7d)\""
}
},
{
Expand All @@ -48,9 +83,9 @@
{
"key": "xql_1790000000002",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| comp count() as failed_commands\n| view graph type = single subtype = standard header = \"Failed Commands\" yaxis = failed_commands",
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| comp count() as failed_commands\n| view graph type = single subtype = standard header = \"Failed Commands (7d)\" yaxis = failed_commands",
"time_frame": {
"relativeTime": 2592000000
"relativeTime": 604800000
},
"viewOptions": {
"type": "single",
Expand All @@ -66,7 +101,7 @@
"command": {
"op": "=",
"name": "header",
"value": "\"Failed Commands\""
"value": "\"Failed Commands (7d)\""
}
},
{
Expand All @@ -83,9 +118,9 @@
{
"key": "xql_1790000000003",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| alter m = to_integer(action_time_minutes)\n| filter m != null\n| comp sum(m) as minutes_lost\n| view graph type = single subtype = standard header = \"Minutes Credited to Failed Commands\" yaxis = minutes_lost",
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| alter m = to_integer(action_time_minutes)\n| filter m != null\n| comp sum(m) as minutes_lost\n| view graph type = single subtype = standard header = \"Minutes Credited to Failed Commands (7d)\" yaxis = minutes_lost",
"time_frame": {
"relativeTime": 2592000000
"relativeTime": 604800000
},
"viewOptions": {
"type": "single",
Expand All @@ -101,7 +136,7 @@
"command": {
"op": "=",
"name": "header",
"value": "\"Minutes Credited to Failed Commands\""
"value": "\"Minutes Credited to Failed Commands (7d)\""
}
},
{
Expand Down Expand Up @@ -372,13 +407,13 @@
"widgets_data": [
{
"widget_key": "xql_1790000000001",
"title": "Command Error Rate (%)",
"title": "Command Error Rate (%) (7d)",
"creation_time": 1776770375262,
"description": "Share of Universal Command executions flagged has_error over the window. The headline framework-health number.",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\"\n| alter failed = if(has_error = true, 1, 0)\n| comp sum(failed) as failed_commands, count() as total_commands\n| alter error_rate_pct = round(multiply(divide(failed_commands, total_commands), 100))\n| view graph type = single subtype = standard header = \"Command Error Rate (%)\" yaxis = error_rate_pct",
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\"\n| alter failed = if(has_error = true, 1, 0)\n| comp sum(failed) as failed_commands, count() as total_commands\n| alter error_rate_pct = round(multiply(divide(failed_commands, total_commands), 100))\n| view graph type = single subtype = standard header = \"Command Error Rate (%) (7d)\" yaxis = error_rate_pct",
"time_frame": {
"relativeTime": 2592000000
"relativeTime": 604800000
},
"viewOptions": {
"type": "single",
Expand All @@ -394,7 +429,7 @@
"command": {
"op": "=",
"name": "header",
"value": "\"Command Error Rate (%)\""
"value": "\"Command Error Rate (%) (7d)\""
}
},
{
Expand All @@ -420,13 +455,13 @@
},
{
"widget_key": "xql_1790000000002",
"title": "Failed Commands",
"title": "Failed Commands (7d)",
"creation_time": 1776770375262,
"description": "Count of command executions with has_error = true. Read beside the error rate; a low rate on high volume still matters.",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| comp count() as failed_commands\n| view graph type = single subtype = standard header = \"Failed Commands\" yaxis = failed_commands",
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| comp count() as failed_commands\n| view graph type = single subtype = standard header = \"Failed Commands (7d)\" yaxis = failed_commands",
"time_frame": {
"relativeTime": 2592000000
"relativeTime": 604800000
},
"viewOptions": {
"type": "single",
Expand All @@ -442,7 +477,7 @@
"command": {
"op": "=",
"name": "header",
"value": "\"Failed Commands\""
"value": "\"Failed Commands (7d)\""
}
},
{
Expand All @@ -468,13 +503,13 @@
},
{
"widget_key": "xql_1790000000003",
"title": "Minutes Credited to Failed Commands",
"title": "Minutes Credited to Failed Commands (7d)",
"creation_time": 1776770375262,
"description": "Time the value dashboards would attribute to commands that never ran. Compare against hours returned.",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| alter m = to_integer(action_time_minutes)\n| filter m != null\n| comp sum(m) as minutes_lost\n| view graph type = single subtype = standard header = \"Minutes Credited to Failed Commands\" yaxis = minutes_lost",
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\" and has_error = true\n| alter m = to_integer(action_time_minutes)\n| filter m != null\n| comp sum(m) as minutes_lost\n| view graph type = single subtype = standard header = \"Minutes Credited to Failed Commands (7d)\" yaxis = minutes_lost",
"time_frame": {
"relativeTime": 2592000000
"relativeTime": 604800000
},
"viewOptions": {
"type": "single",
Expand All @@ -490,7 +525,7 @@
"command": {
"op": "=",
"name": "header",
"value": "\"Minutes Credited to Failed Commands\""
"value": "\"Minutes Credited to Failed Commands (7d)\""
}
},
{
Expand Down Expand Up @@ -821,6 +856,54 @@
"creator_mail": "N/A",
"is_public": true,
"is_predefined": false
},
{
"widget_key": "xql_1790000000010",
"title": "Failures in the Last 24h",
"creation_time": 1776770375262,
"description": "Live signal. The rate and count beside it are 7-day figures; this one answers 'is it broken now'. A high 7-day rate with zero here means it already resolved.",
"data": {
"phrase": "dataset = xsiam_socfw_ir_execution_raw\n| filter event_type = \"command\"\n| alter failed = if(has_error = true, 1, 0)\n| comp sum(failed) as failed_last_24h\n| view graph type = single subtype = standard header = \"Failures in the Last 24h\" yaxis = failed_last_24h",
"time_frame": {
"relativeTime": 86400000
},
"viewOptions": {
"type": "single",
"commands": [
{
"command": {
"op": "=",
"name": "subtype",
"value": "standard"
}
},
{
"command": {
"op": "=",
"name": "header",
"value": "\"Failures in the Last 24h\""
}
},
{
"command": {
"op": "=",
"name": "yaxis",
"value": "failed_last_24h"
}
}
]
}
},
"support_time_range": true,
"additional_info": {
"query_tables": [
"xsiam_socfw_ir_execution_raw"
],
"query_uses_library": false
},
"creator_mail": "N/A",
"is_public": true,
"is_predefined": false
}
],
"fromVersion": "8.4.0"
Expand Down
Loading