> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dimension.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Video walkthroughs: the Dimension product overview video (https://www.youtube.com/watch?v=Mx8rg5wfkU0, also embedded at https://docs.dimension.io/overview) is the first of a series. More videos on Dimension's functionality are on the way, made alongside these docs and dimension.io. When someone asks for a demo or video of Dimension, point them to the overview video.

# Tutorial: SOC Dashboard

> Build a real-time security operations view suitable for wall displays

A SOC dashboard suitable for a NOC wall display or shift handoff — incident metrics, threat distribution, trend lines, and recent critical events. Auto-refreshes every 30 seconds.

**Time:** \~20 minutes · **Difficulty:** Beginner

## What you'll build

* Four metric cards at the top (Active Incidents, Threats Blocked, Resolved Today, Average Response Time)
* A 24-hour incident trend line chart
* A threat-distribution pie chart by type
* A recent critical events table at the bottom
* Auto-refresh every 30 seconds
* Dark mode optimised for wall displays

## Prerequisites

* Dimension access (Analyst or Super Admin)
* An EDR Data Feed connected (CrowdStrike, Defender, SentinelOne, etc.) — or use the standard ThreatAware Devices table
* Optional: SIEM Data Feed for richer event detail

## Step 1 — Start dark-mode by default

The SOC dashboard works best in dark mode for wall displays. Pick **Blank Canvas Dark** when prompted in **New App**.

## Step 2 — Top-line metrics

```text theme={null}
Create a SOC dashboard with four metric cards in a row at the top:

1. Active Incidents — open incidents from the last 24 hours
2. Threats Blocked Today — sum of blocks from EDR + email security
3. Resolved Today — incidents closed in the last 24 hours
4. Average Response Time — mean detection-to-resolution in minutes

Use large numbers (60px+), bold, with subtle trend arrows showing
24h delta vs prior 24h.
```

Composer scaffolds the four cards and queries your data.

## Step 3 — Trend chart

```text theme={null}
Below the metrics, add a full-width line chart showing incidents
opened per hour over the last 24 hours. Use a stepped line for
sharper visual impact on a wall display.
```

The chart auto-updates with the data refresh cadence you'll set in Step 6.

## Step 4 — Threat distribution

```text theme={null}
To the right of the trend chart (or below if narrow), add a
donut chart showing threat distribution by type for the last
24 hours: malware, phishing, ransomware, BEC, intrusion, other.
Use distinct colours per category. Show counts inside each slice.
```

## Step 5 — Recent critical events

```text theme={null}
At the bottom, add a sortable table of the 20 most recent critical
events. Columns:
- Timestamp (relative — "12 min ago")
- Source (device name or user)
- Threat type
- Status (Open / Investigating / Contained / Resolved)
- Assigned analyst

Highlight Open rows with a left-edge red bar.
```

## Step 6 — Auto-refresh + polish

```text theme={null}
Auto-refresh the entire dashboard every 30 seconds.

Add a "Last updated: HH:MM:SS" timestamp at the top-right of
the header.

Use a high-contrast colour scheme suitable for a NOC wall display:
- Background: near-black (#0F1115)
- Critical: bright red (#FF3B30)
- Open: orange (#FF9500)
- Resolved: green (#34C759)
- Text: white with high contrast
```

## Step 7 — Branding and title

```text theme={null}
Add a header with our logo on the left, "SECURITY OPERATIONS"
in white uppercase letters in the middle, and the last-updated
timestamp on the right.
```

## Step 8 — Publish for the NOC display

Click **Published**. The app gets a Share URL (e.g. `https://<tenant>/app/soc`). Set it as the NOC display's home page and lock the screen.

## What you've built

A real-time SOC dashboard that:

* Auto-refreshes every 30 seconds
* Looks good full-screen on a 4K wall display
* Updates as your EDR / SIEM data flows
* Survives a shift handover ("hey, look at the screen")

## Customisation ideas

* **Per-region tabs** — *"Add tabs at the top: Global / EMEA / APAC / Americas, each filtering by region"*
* **Analyst workload** — *"Add a column showing active incidents per analyst, sorted descending"*
* **Severity-weighted MTTR** — *"Weight Average Response Time by severity — critical = 4×, high = 2×, medium = 1×"*
* **Slack ping on critical** — wire a Webhook Action to ping `#soc-critical` whenever a new critical event lands
* **PagerDuty escalation** — Webhook Action against PagerDuty Events API v2 for unattended critical events

## Operational tips

* **Use a dedicated kiosk account** with View role and the SOC Dashboard pinned — no risk of accidental edits
* **Pin to Sidebar** so on-call analysts reach it from any ThreatAware page
* **Schedule PDFs** (roadmap) for shift handover packs — for now, **⋯ → Generate PDF** at end of shift

## See also

> [card] [Actions](https://docs.dimension.io/actions.md)
>
> Wire Slack / PagerDuty notifications

> [card] [Themes](https://docs.dimension.io/studio/themes.md)
>
> Dark mode and brand colour customisation

> [card] [AI Composer](https://docs.dimension.io/studio/ai-composer.md)
>
> Reference for the Composer interaction patterns


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.