Tutorial: SOC Dashboard

What you’ll build

• Four metric cards at the top (Active Incidents, Threats Blocked, Resolved Today, Average Response Time)
• A 24-hour incident trend line chart
• A threat-distribution pie chart by type
• A recent critical events table at the bottom
• Auto-refresh every 30 seconds
• Dark mode optimised for wall displays

Prerequisites

• Dimension access (Analyst or Super Admin)
• An EDR Data Feed connected (CrowdStrike, Defender, SentinelOne, etc.) — or use the standard ThreatAware Devices table
• Optional: SIEM Data Feed for richer event detail

Step 1 — Start dark-mode by default

Step 2 — Top-line metrics

Create a SOC dashboard with four metric cards in a row at the top:

1. Active Incidents — open incidents from the last 24 hours
2. Threats Blocked Today — sum of blocks from EDR + email security
3. Resolved Today — incidents closed in the last 24 hours
4. Average Response Time — mean detection-to-resolution in minutes

Use large numbers (60px+), bold, with subtle trend arrows showing
24h delta vs prior 24h.

Step 3 — Trend chart

Below the metrics, add a full-width line chart showing incidents
opened per hour over the last 24 hours. Use a stepped line for
sharper visual impact on a wall display.

Step 4 — Threat distribution

To the right of the trend chart (or below if narrow), add a
donut chart showing threat distribution by type for the last
24 hours: malware, phishing, ransomware, BEC, intrusion, other.
Use distinct colours per category. Show counts inside each slice.

Step 5 — Recent critical events

At the bottom, add a sortable table of the 20 most recent critical
events. Columns:
- Timestamp (relative — "12 min ago")
- Source (device name or user)
- Threat type
- Status (Open / Investigating / Contained / Resolved)
- Assigned analyst

Highlight Open rows with a left-edge red bar.

Step 6 — Auto-refresh + polish

Auto-refresh the entire dashboard every 30 seconds.

Add a "Last updated: HH:MM:SS" timestamp at the top-right of
the header.

Use a high-contrast colour scheme suitable for a NOC wall display:
- Background: near-black (#0F1115)
- Critical: bright red (#FF3B30)
- Open: orange (#FF9500)
- Resolved: green (#34C759)
- Text: white with high contrast

Step 7 — Branding and title

Add a header with our logo on the left, "SECURITY OPERATIONS"
in white uppercase letters in the middle, and the last-updated
timestamp on the right.

Step 8 — Publish for the NOC display

What you’ve built

• Auto-refreshes every 30 seconds
• Looks good full-screen on a 4K wall display
• Updates as your EDR / SIEM data flows
• Survives a shift handover (“hey, look at the screen”)

Customisation ideas

• Per-region tabs — “Add tabs at the top: Global / EMEA / APAC / Americas, each filtering by region”
• Analyst workload — “Add a column showing active incidents per analyst, sorted descending”
• Severity-weighted MTTR — “Weight Average Response Time by severity — critical = 4×, high = 2×, medium = 1×”
• Slack ping on critical — wire a Webhook Action to ping #soc-critical whenever a new critical event lands
• PagerDuty escalation — Webhook Action against PagerDuty Events API v2 for unattended critical events

Operational tips

• Use a dedicated kiosk account with View role and the SOC Dashboard pinned — no risk of accidental edits
• Pin to Sidebar so on-call analysts reach it from any ThreatAware page
• Schedule PDFs (roadmap) for shift handover packs — for now, ⋯ → Generate PDF at end of shift

See also