Configuring blocks
Each block in the dashboard grid is configured through a side panel that lets you choose what data to display and how to visualize it. Start from a template for common views, or build a fully custom block.
Opening the configuration panel
The configuration side panel opens when you:
- Click Add data between rows, the add block icon at the end of a row, or Add data card from the overflow menu to create a new block
- Click the edit button on an existing block's toolbar
- Press Enter on a focused block in edit mode
Template library
The template library provides quick-start blocks for common dashboard views:
- Active browsers — Metric card showing the count of active browsers
- Safeguards triggered — Bar chart of safeguard activity by category
- Events by policy — Donut chart breaking down events by policy category
- Risky users — Bar chart highlighting users with the most risk events
Select a template to add it to your grid immediately. Edit the block afterward to customize it further.
Custom block builder
The custom builder uses progressive disclosure to walk you through the block configuration. The form is organized into four sections:
Name
- Title — A display name for the block.
- Subtitle — An optional description of what the card shows.
Configure
- Entity — Choose the data source: Events, Users, Browsers, Devices, Extensions, or Applications.
- Filter — Optionally narrow the data shown in the block. Multiple filters can be added, and available filter fields depend on the selected entity type.
Visualization
- Visualization type — Select how to display the data. Available types depend on the entity; see Chart types reference for the full list.
- Group by — Pick the field to break down data by (e.g., severity, category, user label, application name). Required for breakdown charts, optional for metric cards, and not applicable to over-time charts.
- Stack by — Optionally add a secondary dimension to produce stacked bar segments. Only available for horizontal bar and vertical bar charts, and requires a Group by field to be selected first.
- Live preview — A real-time preview updates as you change options, showing how the block will appear in your dashboard.
Additional configuration
These options vary depending on the visualization type and entity:
| Option | Description | Available For |
|---|---|---|
| Apply time range | Scope data to the dashboard's selected date range. Enabled by default. | Non-event entities |
| Show trend | Display a trend indicator alongside the value. | Event-based metric cards only |
| Interval | Set the time bucket size: Auto, 15 min, 30 min, 1 hour, 3 hours, 6 hours, 12 hours, or 1 day. | Area chart, bar over time chart |
| Show count | Display a count header above the chart, or centered within the donut for donut charts. | All charts |
| Show trends | Display per-item trend deltas next to bar values. | Horizontal bar, vertical bar (events only) |
| Max results | Limit the number of items shown (3, 5, or 10). | Breakdown charts, ranking table |
| Show legend | Display a color legend below the chart. | Donut chart, stacked bar chart |
| See all footer | Show a "See all" link to the entity page with the block's filters applied. | Ranking table only |
| Chart color | Pick a color from the palette for the chart. | Charts with non-enum group-by fields (excluding donut, stacked bar) |
Live preview
As you change configuration options in the side panel, a live preview updates in real time to show how the block will appear in your dashboard. This lets you iterate on the visualization without leaving the configuration panel.
Editing an existing block
When you open the configuration panel for an existing block, the form is pre-filled with the block's current settings. The live preview reflects your changes as you make them. Changes are applied to the grid when you save in the panel. Closing or navigating away discards them.