Dashboards and Notebooks extend the Search page. You write a SQL query, turn its result into a widget (chart, table or pivot), and place widgets on a dashboard. Notebooks chain several queries together, with notes between them.
The legacy Dashboards and Notebooks will be removed soon.
- Notebooks have already been migrated for you. Your legacy notebooks are available in the new Notebooks.
- Dashboards are not migrated automatically. Rebuild the ones you need as new dashboards. For help, contact Hunters Support or your TAM.
Three things that explain most behavior
A widget is a copy, not a link. When you add a chart to a dashboard, the dashboard gets its own private copy of the query. Later edits never flow in either direction: not from the original query to the dashboard, and not back.
The dashboard time range applies to each widget separately. Each widget names one of its columns as its time column, and the dashboard's time range filters that column. A widget with no time column ignores the time range entirely.
Results are cached and shared. Widgets show a cached result, and Last updated tells you its age. A result expires after 24 hours. A refresh or a scheduled email replaces the cached result for everyone viewing the dashboard.
Data types
SQL mode runs against one of three data types:
| Data type | Contains | SQL dialect |
|---|---|---|
| RAW Data | Your events as ingested (source tables) | Snowflake |
| OCSF Data | The same events, normalized to OCSF | Snowflake |
| Analytics | Hunters' own findings: leads, alerts, scores, assignees, audit logs | PostgreSQL |