As we have explored in prior blog posts, Endgame uses Elasticsearch as its main data store for its alerts and investigation workflows. Moreover, a number of our customers and prospects rely on Elasticsearch to collect, analyze and visualize their security data. Last June, we<a href="https://www.endgame.com/blog/executive-blog/joining-forces"> announced</a> the exciting news that Endgame entered into an acquisition agreement with Elastic, however even prior to these discussions, it became clear that our customers would see significant value in being able to integrate their Endgame data into their instance of Elastic. Endgame offers integrations into other SIEM and similar products (such as Splunk and ServiceNow), and soon, we hope to make Elastic Stack Integration (Beta) available to our customers in an upcoming release. With this feature, Endgame can stream all endpoints and events directly into a user’s Elastic Stack. This feature allows users to store and search Endgame data directly in Elastic and use the variety of applications offered by Elastic.
As this year’s Product Design Intern, I thought it would be a great opportunity to explore this feature for my summer project. I wanted to highlight one of Elastic’s applications, Canvas, and explore its capabilities using data streamed from Endgame. Canvas is an application that allows users to create highly customizable dashboards using real-time data. Compared to Elastic’s other visualization apps, Canvas’ built-in editing controls and powerful expression editor gives users complete control to create useful and dynamic dashboards. This seemed like the perfect tool for me to use as a designer.
With Black Hat in early August, I had only a few weeks to come up with a design idea, implement it, and have it presentation-ready for the conference.
<h2>The Alert Dashboard</h2>Dashboards give a high-level overview about the overall health of an environment and provide metrics for easy report generation that many security teams are required to make. While current platform features like Reporting fulfill these needs, I decided to take this opportunity to improve upon our dashboards without the limitation of designing within the current Endgame platform. Since Elastic doesn’t currently have a way to visualize security alerts within their stack, I thought an alert dashboard would be a good place to start.
<h2>Preparation</h2>The first step to creating an alert dashboard was gathering information to decide what to include. I referenced existing dashboards and reporting metrics we use to make this decision. I also had the opportunity to interview some of our actual users and gather their impressions. Through these discussions, I learned that managers were the ones who gained the most value from dashboards and wanted an overview of the health of their security environment.
I used this research to decide what type of visualization matched the type of information users wanted to see. Afterwards, I created a rough template of how to organize these elements. With this preparation, I had a good sense of what I wanted the final dashboard to look like.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blta9da986869e3b268/5e0e2a5ec03d7c5f9d111e89/endgame-canvas-dashboards-template-blog.png" data-sys-asset-uid="blta9da986869e3b268" alt="endgame-canvas-dashboards-template-blog.png" style="display: block; margin: auto;">
<figcaption>An early dashboard template</figcaption><h2>Design Process</h2>The first step to creating an alert dashboard was to parse through the data streamed into the Elastic Stack and create the metrics I wanted. Even with only a beginner’s background in SQL, it was relatively simple for me to compose queries for the metrics I wanted displayed. Elastic also has several<a href="https://www.elastic.co/blog/elasticon-kibana-canvas-story-elasticoffee"> introductory</a><a href="https://www.elastic.co/blog/elasticon-kibana-canvas-story-ama"> tutorials</a> about Canvas that are helpful to those unfamiliar with SQL.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltf399047cd50c19c1/5e0e2a9c36b15c3efa684787/endgame-canvas-dashboards-sql-stmnt-gif-blog.gif" data-sys-asset-uid="bltf399047cd50c19c1" alt="endgame-canvas-dashboards-sql-stmnt-gif-blog.gif" style="display: block; margin: auto;">
<figcaption>A gif of a SQL statement being written to display live data</figcaption>After all the visualizations were made, the next step was the fun part: styling them! Canvas has several in-app controls to edit an element’s color palette, text styling, and more. However, for those who really want absolute customization, there’s an option to directly edit an element’s CSS stylesheet. I wanted to emulate the feel of the current Endgame platform, so I used Endgame branding and color choices throughout my design.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd3a1c7c60db2e61b/5e0e2ad4300bb3438c39b146/endgame-canvas-dashboards-in-app-style-controls-blog.gif" data-sys-asset-uid="bltd3a1c7c60db2e61b" alt="endgame-canvas-dashboards-in-app-style-controls-blog.gif" style="display: block; margin: auto;">
<figcaption>A gif of the in-app style controls in use.</figcaption><h2>The Finished Product</h2><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt8855db0f18625ce0/5e0e2b1fc848085fa46e765a/endgame-canvas-dashboards-alert-dash-v1-blog.png" data-sys-asset-uid="blt8855db0f18625ce0" alt="endgame-canvas-dashboards-alert-dash-v1-blog.png" style="display: block; margin: auto;">
<figcaption>Version one of the alert dashboard</figcaption> 
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt605b072417afd60a/5e0e2b3394b1d7403bbd4f15/endgame-canvas-dashboards-alert-dash-v2-blog.png" data-sys-asset-uid="blt605b072417afd60a" alt="endgame-canvas-dashboards-alert-dash-v2-blog.png" style="display: block; margin: auto;">
<figcaption>Version two of the alert dashboard</figcaption>After several iterations and helpful feedback from my co-workers, the alert dashboard was finished! I created two versions that contained similar visualizations with varying color palettes and organization.
<h2>Customization Capabilities</h2>I created these dashboards to be displayed at the 2019 Black Hat conference earlier this month. They were one of the talking points of the Elastic Integration demo.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd7b5dce68360d0b8/5e0e2e22add2c65f84d123ab/endgame-canvas-dashboards-blackhat-booth-blog.jpg" data-sys-asset-uid="bltd7b5dce68360d0b8" alt="endgame-canvas-dashboards-blackhat-booth-blog.jpg" style="display: block; margin: auto;"><figcaption>A picture of the Canvas Dashboard presented at the Endgame booth at Black Hat</figcaption>However, while I created two versions of the alert dashboard for Black Hat, there are infinite possibilities for how the dashboard could look. One of the best parts of Canvas is its limitless customization capabilities. I came up with almost a dozen different layouts. Any of these dashboards would be great depending on how users want to visualize their information. For example, some users want as much information as possible and to see a detailed breakdown of each element. Others might want a general picture and only desire to see the highest level metrics and trends.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt0318ba147bea644b/5e0e2b8499f6f64041a2b712/endgame-canvas-dashboards-dash-variations-blog.png" data-sys-asset-uid="blt0318ba147bea644b" alt="endgame-canvas-dashboards-dash-variations-blog.png" style="display: block; margin: auto;">
<figcaption>Some of the many dashboard variations I created during this project</figcaption><h2>Next Steps</h2>It was an incredibly fun project to create a new alert dashboard from scratch. As a summer intern, it was awesome to see my dashboard prominently displayed at Black Hat. After exploring the Canvas application, I can say even those without a design or technical background are able to make visually striking dashboards with valuable data.
If you’re interested in learning more about the Elastic Stack Integration (Beta), feel free to reach out<a href="https://pages.endgame.com/request-demo-website.html"> here</a>. Either way, this is an exciting look into the possibilities of what will come out of the Endgame and Elastic partnership, so look forward to what happens next!

blog-banner-generic-black.png

blog-thumb-generic-black.png

Visualizing security data with Canvas

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Monina Nepomuceno

Надсилаючи цю форму ви погоджуєтеся з <a href="/legal/terms-of-use">Умовами надання послуг Elastic</a>. Ваші особисті дані будуть опрацьовані відповідно з <a href="/legal/privacy-statement">Положеннями про конфіденційність Elastic</a>.

Newsletter GDPR Text - Ukrainian

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

Intentionally Blank

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

提交即表示您確認已詳閱並同意我們的<a href="/legal/elastic-cloud-account-terms" target="_blank">服務條款</a>，且同意 Elastic 使用您在上方提供的個人資料<a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">與您聯絡</a>，為您提供相關產品和服務的資訊。如需詳細說明或隨時想停止收到產品和服務資訊，請參閱 <a href="/legal/privacy-statement/" target="_blank">Elastic 的隱私聲明</a>。

Newsletter GDPR Text - TW

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.By submitting this form, I agree to Elastic sharing my contact information with Google Cloud. I also agree to Elastic giving my information to the vendor for the purpose of shipping my food package.

GDPR Text + Google Cloud

Inviando la registrazione (1) esprimi il consenso ai <a href="/legal/terms-of-use">termini e condizioni di Elastic</a> e <a href="/legal/privacy-statement">all’informativa sulla privacy</a>, nonché (2) a ricevere saltuarie e-mail.

Newsletter GDPR Text - Italian

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

Load more

Overview

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content.

You'll also receive an email with related content.

You'll also receive an email with related content

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

Author

Articles by Monina Nepomuceno

Visualizing security data with Canvas