Creating a Chart
To add a new chart to a dashboard:
Log in to your Lucidum system.
In the left menu, click Home > Dashboards.
In the Channel pane, click the channel where the dashboard lives.
In the right pane, find the dashboard you want to edit. Click the dashboard name.
Lucidum loads the dashboard.
In the dashboard, click the Add Chart button.
The New Chart page appears:
In the New Chart page, supply values in the fields:
Start from here. Build a query. See the section on Building a Query for details. This query creates a set of records for the chart.
Summary. Specify the columns you want to display in the chart. The Summary fields allow you to sort the data results from the Start from here field. For details on the summary fields, see the section Using the Summary fields.
For example, suppose in the Start from here field, you created a query that retrieved a list of all assets which have a risk score equal to or greater than 15.65 and a time span of current. Suppose the query results include the records for 156 assets.
You can use the Summary field to specify how to display those 156 assets. Instead of Lucid Asset Name, you can select any of the column names in the query results to display on the y-axis. And instead of Risk Score, you can select any of the column names to display in the x-axis.
For example, suppose we kept “Count of Lucid Asset Name” in the y-axis. But instead of Risk Score, we chose to display Department on the x-axis. Our chart would look like this:
We now have a chart of all assets with a risk score of 15.65 or greater, organized by department.
Chart Title. Provide a title for the chart.
Chart Types. Choices are:
Bar. A bar graph, typically with a count value on the y-axis and a measurement or category on the x-axis.
Stacked. A stacked bar graph, typically with a count value on the y-axis and a measurement or category on the x-axis. Each category on the x-axis includes color-coded sub-categories. For example, you create a bar graph that shows number of assets per location. For each location, the bar could include color-coded sub-categories that map to the type of operating system. For details on enabling this chart type, see the section on Stacked.
Pie. A graph that shows proportions. Each slice represents a category; the “pie” represents the entire population.
Nested. A nested pie chart shows two types of related values. The color coding shows which values are related. For example, a nest pie chart could have an inner circle with general types of operating systems (Linux, Mac, Windows) for a group of assets. The outer circle could include versions of operating systems for the same group of assets. The color coding shows which versions go with which general type of operating system. If Windows was green, Windows Server 2019 and Windows Server 2022 would also be green. For details on enabling this chart type, see the section on Nested.
Line. A graph shows a count value on the y-axis and a measurement (usually time) on the x-axis.
Gauge. A ring gauge chart displays up to four nested field values on a circular gauge. These charts work best for a field value that can returns values like “critical, high, medium, low”. For details on enabling this chart type, see the section on Gauge.
Table. Data sorted by rows (one per instance) and columns (values that describe each instance).
Histogram. Uses bars to represent the distribution of values. The y-axis measures a count value, and the x-axis includes intervals (ranges of data) called bins. Note that the Histogram chart type is available only for data sets that include a numeric range on the x-axis. If in the Summary fields you did not specify a data set that includes a numeric range on the x-axis, the Histogram chart type is disabled.
Big Number. Displays a single count value. Note that the Big Number chart type is available only for data sets that are count only. For data sets that are not count only, the Big Number chart type is disabled.
Heat Map. This chart includes a heat map based on a calendar, where values are assigned to each day in the calendar, and the values include five color-codes, from minimum value to maximum value. For example, supposed the filter was looked for assets with a Risk Value of “High” over the last 90 days. Suppose 100 assets met the filter criteria. The heatmap would include color codes for 0-20 (assets), 20-40, 40-60, 60-80, 80-100. The color codes would be applied to each day in the calendar. The calendar would include the last 90 days. For details on enabling this chart type, see the section on Heatmap.
The Chart Types field determines the remaining fields. For details, see the section on More Settings.
Using the Summary fields
The query in the Start from here fields defines the data set for the chart. The records returned by the query are the data set for the chart.
The Summary fields organize the data set for presentation. You can select columns from the data set to display in the chart.
The following sections explain the fields in the Summary fields.
Operator
count. Organize data by the number of instances of a selected column name.
min. Organize data by the minimum value of a selected column name.
max. Organize data by the minimum value of a selected column name.
sum. Organize data by the sum of a selected column name.
average. Organize data by the average value of a selected column name.
list. Organizes data in a table. This option is for charts of type Table or Stacked Bar. After selecting list, you can select one or more Column Values from the field to the right.
In a Table chart, each Column Value becomes a column name in the table. Note that the columns appear in the table in the order you enter values in the Column Value field.
In a Stacked Bar chart, the first Column Value must be the same value as in the By field, and the following Column Values are the sub-categories in each bar.
Column Value
Select a column value from the list of all columns included in the results of the query (specified in the Start from here field). The operator and this value appear in the chart. For example, this value could appear in the y-axis of a bar graph, like “count of # of users”.
by field
Select a column value from the list of all columns included in the results of the query (specified in the Start from here field). This is the second value in the graph. For example, this value could appear in the x-axis of a bar-graph, like “department”. Using the example from Column Value, a bar chart could show number of users on the y-axis and the department on the x-axis.
More Settings
These settings specify how to format the chart. The settings depend on the chart type.
The following sections display the additional settings for each chart type
Numeric Type
To avoid repeating this section, Numeric Data Types for charts that use numeric values are:
int. Positive numeric value (no decimal point).
int signed. Positive or negative numeric value (no decimal point)
float 1 point. Positive numeric value with 1 place after the decimal
float 2 point. Positive numeric value with 2 places after the decimal
float 3 point. Positive numeric value with 3 places after the decimal
Dollar. Dollar value with two places after the decimal
dollar_signed. Positive or negative dollar value with two places after the decimal
dollar_round value. Dollar value with no decimal point
dollar_round_signed. Positive or negative dollar value with no decimal point
float signed 1 point. Positive or negative numeric value with 1 place after the decimal
float signed 2 point. Positive or negative numeric value with 2 places after the decimal
float signed 3 point. Positive or negative numeric value with 3 places after the decimal
percent 1 point. Positive percent value with 1 place after the decimal
percent 2 point. Positive percent value with 2 places after the decimal
percent 3 point. Positive percent value with 3 places after the decimal
percent signed 1 point. Negative or positive percent value with 1 place after the decimal
percent signed 2 point. Negative or positive percent value with 2 places after the decimal
percent signed 3 point. Negative or positive percent value with 3 places after the decimal
SI 1 DIGIT. International system of units. For details, see https://mathworld.wolfram.com/SIPrefixes.html . Values will be displayed with no decimal point. For example, 8,288 would be displayed at 8K.
SI 2 DIGIT. International system of units. For details, see https://mathworld.wolfram.com/SIPrefixes.html . Values will be displayed with one place after the decimal point. For example, 8,288 would be displayed at 8.3K.
SI 3 DIGIT. International system of units. For details, see https://mathworld.wolfram.com/SIPrefixes.html . Values will be displayed with two places after the decimal point. For example, 8,288 would be displayed at 8.28K.
Bar
A bar chart typically includes a count value on the y-axis and a measurement or category on the x-axis.
If you select Bar as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
X Axis Title. Label for the x-axis.
Y Axis Title. Label for the y-axis.
Sort by. Sort the chart by one of the keywords in the filter. You can choose ascending sort (shortest bar first) or descending sort (longest bar first). Bars are ordered by the selected property and ascending or descending.
Number of X Axis Labels (< or = 100). Number of bars on the x-axis.
Rename X Axis Labels. By default, the x-axis labels are assigned values from the Lucidum system. If you would like to rename a label:
In the field on the left, enter the name of label you want to edit.
In the field on the right, enter the new label name.
Numeric Data Type. See the previous section on Numeric Type.
Stacked
A stacked bar chart is a bar chart, typically with a count value on the y-axis and a measurement or category on the x-axis. Each category on the x-axis includes color-coded sub-categories. For example, you could create a stacked bar chart that shows he tnumber of assets per location. For each location, the bar could include color-coded sub-categories that map to the type of operating system.
To enable the Stacked bar chart, use the settings in this order:
By. Select a column value. This value will be the value on the x-axis.
Operator. Select List.
Column Value. Select the same column value you selected in the By field. Then select additional value to appear in the stacked bars.
Select the Stacked bar chart.
If you select Stacked as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
X Axis Title. Label for the x-axis.
Y Axis Title. Label for the y-axis.
Rename X Axis Labels. By default, the x-axis labels are assigned values from the Lucidum system. If you would like to rename a label:
In the field on the left, enter the name of label you want to edit.
In the field on the right, enter the new label name.
Number of Rows. Specify the number of assets or user to include in the table. Limit is 2,000.
Numeric Data Type. See the previous section on Numeric Type.
To see an example of a stacked bar chart, see Stacked Example.
Pie
If you select Pie as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title. Number
Number of Labels (< or = 100). Number of slices in the pie.
Show Label. Displays a callout with a numeric description of each slice of the pie.
Show Legend. Displays a color-coded legend for each slice of the pie.
Rename Labels. By default, the labels are assigned values from the Lucidum system. If you would like to rename a label:
In the field on the left, enter the name of label you want to edit
In the field on the right, enter the new label name
Numeric Data Type. See the previous section on Numeric Type.
Nested
A nested pie chart shows two types of related values. The color coding shows which values are related. For example, a nest pie chart could have an inner circle with general types of operating systems (Linux, Mac, Windows) for a group of assets. The outer circle could include versions of operating systems for the same group of assets. The color coding shows which versions go with which general type of operating system. If Windows was green, Windows Server 2019 and Windows Server 2022 would also be green.
To enable the Nested bar chart, use the settings in this order:
By. Select a column value. This value will be the center ring.
Operator. Select List.
Column Value. Select the same column value you selected in the By field. Then select an additional value to appear in the outer ring.
Select the Nested pie chart.
If you select Nested as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title. Number
Number of Rows. Number of assets or users to include in the chart. Limit is 2,000.
Show Label. Displays a callout with a numeric description of each slice of the pie.
Show Legend. Displays a color-coded legend for each slice of the pie.
Rename Labels. By default, the labels are assigned values from the Lucidum system. If you would like to rename a label:
In the field on the left, enter the name of label you want to edit
In the field on the right, enter the new label name
To see an example of a nested pie chart, see Nested Example.
Line
If you select Line as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
X Axis Title. Label for the x-axis.
Y Axis Title. Label for the y-axis.
Sort by. Sort the chart by one of the keywords in the filter. You can choose ascending sort or descending sort. You can choose ascending sort (lowest point first) or descending sort (highest point first). Bars are ordered by the selected property and ascending or descending.
Number of X Axis Labels (< or = 100). Number of labels on the x-axis.
Rename X Axis Labels. By default, the x-axis labels are assigned values from the Lucidum system. If you would like to rename a label:
In the field on the left, enter the name of label created by Lucidum.
In the field on the right, enter the new label name.
Numeric Data Type. See the previous section on Numeric Type.
Gauge
A ring gauge chart displays up to four nested field values on a circular gauge. These charts work best for a field value that can returns values like “critical, high, medium, low”.
To enable the ring Gauge bar chart, use the settings in this order:
By. Select a column value that has multiple categories of values.
Select the Gauge pie chart.
If you select Gauge as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
Number of Rows. Number of assets or users to include in the chart. Limit is 2,000.
To see an example of a gauge chart, see Gauge Example.
Table
If you select Table as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
First Column Title. Supply a title for the first column of data.
Second Column Title. Supply a title for the second column of data.
Sort by. Sort the table by one of the keywords in the filter. You can choose ascending sort or descending sort. You can choose ascending sort (lowest value first) or descending sort (highest value first). Bars are ordered by the selected property and ascending or descending.
Number of Total Rows (< or = 100). Specify the number of rows to include in the table.
Number of Rows per Page. Specify the number of rows to include per page. After viewing this number of rows, viewers must scroll to the next page.
Numeric Data Type. See the previous section on Numeric Type.
Histogram
If you select Histogram as a chart type, you can use the following settings to configure the chart:
Number of Bins. The number of intervals (ranges of data) that will appear on the x-axis. The intervals are represented as bars, like a bar graph.
Range of Binning. The total range for all bins.
Subtitle. Secondary title that appears under chart title.
X Axis Title. Label for the x-axis.
Y Axis Title. Label for the y-axis.
Sort by. Sort the chart by one of the keywords in the filter. You can choose ascending sort or descending sort.
Number of X Axis Labels (< or = 100). Number of labels on the x-axis.
Numeric Data Type. See the previous section on Numeric Type.
Big Number
If you select Big Number as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
Numeric Data Type. See the previous section on Numeric Type.
Heatmap
A heatmap chart includes a heat map based on a calendar, where values are assigned to each day in the calendar, and the values include five color-codes, from minimum value to maximum value.
For example, supposed the filter was looked for assets with a Risk Value of “High” over the last 90 days. Suppose 100 assets met the filter criteria. The heatmap would include color codes for 0-20 (assets), 20-40, 40-60, 60-80, 80-100. The color codes would be applied to each day in the calendar. Days with no data appear with no color applied. The calendar would include the last 90 days.
To use the heatmap:
When creating filter, choose With Time Range of History
When creating filter, use an AND and add Last Time Seen. Specify a date range.
Operator. Select Count
Column Value. Select a column value. Typically, this will be Asset Name.
By. Select Last Time Seen.
Select Heatmap chart type.
If you select Heatmap as a chart type, you can use the following settings to configure the chart:
Subtitle. Secondary title that appears under chart title.
Number of Rows. Specify the number of assets or use to include in the heatmap. Limit is 2,000.
To see an example of a heatmap chart, see Heatmap Example.
Bar Example
This chart displays the assets without endpoint protection and shows the count of these assets for each department.
This chart retrieves a list of assets that are not running Symantec Endpoint Protection agent or the SentinelOne agent.
The Start from here field includes this query:
Data Sources not match sepm_protection OR Data Sources not match SentinelOne_agent
This query examines all assets in the current time span and searches for assets that do not include a source for the Symantec Endpoint Protection client or do not include a source for SentinelOne agent.
The Summary fields include:
Count Lucidum Asset Name. Show the number of Assets
by Department. Show the number of assets by department.
order by Lucidum Asset Name in descending order (largest to smallest).
Chart Title. Assets w/o Endpoint Mgt|Sec by Dept
Chart Type. Bar
Stacked Example
This chart displays the number of assets per department and also displays the risk and OS version for each bar.
This chart retrieves a list of assets that include the department field and OS and version field.
The Start from here field includes this query:
Department exists AND OS and Version exists
This query examines all assets in the current time span and searches for assets that include the Department field and the OS and Version field. .
The Summary fields include:
by Department. Show the number of assets by department.
List Department, Risk Level, OS and Version. Include Risk Level and OS and Version in the stacked bar chart.
order by Department in descending order
Chart Title. Departments
Chart Type. Stacked
Nested Example
This chart displays a list of users who are High Risk and also displays Departments that contain high-risk users.
This chart retrieves a list of users who have a Risk Level of 3.
The Start from here field includes this query:
Risk Level match 3-high
This query examines all users in the current time span and searches for users with a Risk Level of 3-High.
The Summary fields include:
by Department. Show the number of high-risk users by department. This will be the center pie chart.
List Department, Lucidum User Name. Include Department and Luicdum User Name in the nested pie chart.
order by Department in descending order
Chart Title. High Risk Users
Chart Type. Nested
Gauge Example
This charts displays the percent of assets in each risk level (low, medium, or high).
This chart retrieves a list of all assets.
The Start from here field includes this query:
Lucidum Asset Name exists
This query examines all assets in the current time span.
The Summary fields include:
by Risk Level. Show the percentage of assets at each risk leve..
count Lucidum Asset Name. Include all assets in the gauge.
order by Lucidam Asset Name Department in descending order
Chart Title. Assets
Chart Type. Gauge
Heatmap Example
This charts uses color-coding to display the count per day of assets with a risk level of “3-high”. The more assets at that risk level, the darker the color. The chart displays a calendar of the last 90 days.
This chart retrieves a list of all assets.
The Start from here field includes this query:
Risk Level match 3-high AND Last Time Seen within past 3 months
This query examines all assets in the historical time span and searches for assets with a risk level of “3-high” seen in the last 3 months.
The Summary fields include:
by Last Time Seen. Displays color-coded range assets with a risk level of “high” by day, showing the last 90 days.
count Lucidum Asset Name. Include all assets from the filter in the heatmap.
order by Lucidam Asset Name Department in descending order
Chart Title. Assets with Risk Level of “High”
Chart Type. Heatmap