Hey everyone! I'm still pretty new to Elastic Security and wanted to share my first real customization. I built a custom lens for our dashboards to track risk scores for Microsoft 365 admin actions.
It helps us spot risky behavior patterns faster. I'm sure it's basic for most of you, but I was excited to get it working! Here's a snippet of the Lens JSON config I modified:
```json
"layers": [
{
"layerId": "data_layer",
"seriesType": "bar_stacked",
"xAccessor": "timestamp",
"splitAccessor": "event.action",
"accessors": ["risk_score"]
}
]
```
Could someone suggest how to make this better? Maybe adding a threshold line or filtering for specific high-risk events? Any beginner-friendly tips would be awesome 😊
Thanks in advance for your help!
This is an excellent foundation for tracking administrative risk. Your stacked bar approach effectively visualizes the distribution of risk across different action types, which is crucial for identifying which admin operations contribute most to your overall risk posture.
Regarding threshold implementation, you'll want to add a reference line at the layer level, not just in the visualization. You can define this in the JSON by adding a `referenceLines` array within your layer. More importantly, consider calculating a rolling average risk score alongside your raw values. This helps distinguish between a single high-risk event and a sustained elevation in risk behavior. You could create a separate metric aggregation for a 7-day moving average of `risk_score` and add it as another accessor.
For filtering high-risk events, I'd recommend against hard-coding filters directly into this lens configuration. Instead, create a control filter at the dashboard level for `risk_score: >70` and link this lens to it. This keeps the lens reusable and allows viewers to adjust the threshold dynamically based on the current threat context. A common next step is to break out actions by `user.id` when the risk score exceeds your threshold, which immediately shifts the view from "what is risky" to "who is acting riskily."
Your splitAccessor on `event.action` is good, but ensure you're also capturing the outcome or result field from the M365 logs. A failed administrative action with a high risk score has very different implications than a successful one, even if the action type is identical.
That's a great starting point for visualizing risk. Your stacked bar chart shows volume, but I'm concerned it might be averaging risk scores across events, which could dilute high-severity outliers. The `risk_score` field in security events is often an integer, and stacking averages might not reflect the true threat level.
Instead of using `risk_score` directly in the accessor, try creating a calculated column first. You could bin scores into categories (e.g., Low: 0-20, Medium: 21-70, High: 71-100) and use that as your splitAccessor. Then, use `records` or `count` as your metric. This shifts the view from "average risk" to "frequency of high-risk events," which is often more actionable for an admin console.
For a threshold, I'd add a separate layer with a formula like `ifelse(average(risk_score) > 75, average(risk_score), null)`. This creates a line that only appears when the average crosses your threshold, making spikes visually jarring.
Data > opinions