building-incident-response-dashboard

# Building Incident Response Dashboard ## When to Use Use this skill when: - IR teams need real-time dashboards during active incidents for coordination and tracking - SOC leadership requires operational dashboards showing incident status and analyst workload - Post-incident reviews need visual timelines and impact assessments - Executive briefings require high-level incident metrics and trend analysis **Do not use** for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting. ## Prerequisites - SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana) - Notable event and incident data in SIEM (Splunk ES incident_review index) - Ticketing system integration (ServiceNow, Jira) for remediation tracking - Asset and identity lookup tables for context enrichment - Dashboard publishing access for SOC team and management distribution ## Workflow ### Step 1: Design Active Incident Dashboard Layout Build a Splunk Dashboard Studio dashboard for active incident tracking: ```xml <dashboard version="2" theme="dark"> <label>Active Incident Response Dashboard</label> <description>Real-time tracking for IR-2024-0450</description> <row> <panel> <title>Incident Summary</title> <single> <search> <query> | makeresults | eval incident_id="IR-2024-0450", status="CONTAINMENT", severity="Critical", affected_hosts=7, ...