Just built a simple dashboard to track Cybereason alert trends in Grafana

Having recently completed a significant deployment of Cybereason across our enterprise endpoints, we were immediately confronted with the classic operational challenge: the platform generates a high-fidelity stream of security alerts, but deriving actionable intelligence and identifying macro-trends from the native management console proved cumbersome for our SOC analysts and leadership. The need was for a historical, at-a-glance view of alert volumes, severities, and categories over time, integrated into our existing operational dashboards.

To address this, I've constructed a purpose-built Grafana dashboard that visualizes Cybereason alert data by querying its REST API. The architectural flow is a straightforward ETL pipeline: a Python-based collector fetches data at regular intervals, transforms it into metrics, and pushes them into Prometheus, which Grafana then queries. The key was structuring the API response into meaningful time-series dimensions.

The collector script, scheduled via cron, performs authenticated calls to the `/rest/visualsearch/query/v1` endpoint with a carefully crafted query to aggregate alerts from the past hour. Here is the core of the data extraction logic:

```python
import requests
import json
import time
from prometheus_client import Gauge

# Prometheus Gauges
alert_total = Gauge('cybereason_alerts_total', 'Total alert count', ['severity', 'category'])
alert_by_machine = Gauge('cybereason_alerts_by_machine', 'Alerts by machine', ['machine_name', 'severity'])

def fetch_alert_metrics():
api_url = "https://.cybereason.net/rest/visualsearch/query/v1"
headers = {"Content-Type": "application/json"}
query = {
"queryPath": [{"requestedType": "Alert", "filters": [], "isResult": True}],
"totalResultLimit": 1000,
"perGroupLimit": 1000,
"perFeatureLimit": 100,
"templateContext": "ALERTS",
"customFields": ["severity", "category", "machineName"]
}
response = requests.post(api_url, headers=headers, json=query, auth=('', ''))
data = response.json()

# Reset gauges to handle disappearing alerts
for metric in [alert_total, alert_by_machine]:
for metric in metric._metrics.values():
metric.clear()

for alert in data.get('data', {}).get('results', []):
sev = alert.get('severity', 'UNKNOWN')
cat = alert.get('category', 'UNKNOWN')
machine = alert.get('machineName', 'UNKNOWN')

alert_total.labels(severity=sev, category=cat).inc()
alert_by_machine.labels(machine_name=machine, severity=sev).inc()
```

The resulting dashboard panels include:
- A time-series graph showing alert count per severity (Critical, High, Medium, Low) over the last 7 days.
- A stacked bar chart breaking down alerts by category (Malware, Suspicious Activity, Exploit, etc.) per day.
- A table showing current alert hotspots by endpoint hostname, sorted by Critical alert count.
- A stat panel showing the percentage change in total alerts compared to the previous week.

Initial results have been illuminating. We've identified a previously unnoticed correlation between a specific software update (tracked in a separate system) and a spike in "Suspicious Activity" alerts every Tuesday morning, which has allowed us to create an exclusion rule and reduce noise by approximately 18%. The integration also provides a shared view for both security and IT operations teams, bridging a visibility gap.

Potential pitfalls to consider:
- The Cybereason API can throttle under heavy load, so aggressive polling intervals are not advised.
- The metric cardinality can explode if you label by every possible dimension; I recommend limiting labels to core attributes like severity, category, and machine.
- Authentication credentials must be securely managed, preferably via a vault, as the script requires significant privileges.

This approach transforms the alert data from a reactive list into a quantifiable, trend-able metric. I am considering expanding the pipeline to feed raw alert logs into a data lake for longer-term retention and more complex correlation analysis outside the Cybereason platform's native retention period.