RD Widgets

Last Updated: October 23, 2026

Overview

A widget draws the data of one saved query as a chart, a table, a number or a list. Widgets are the building blocks of dashboards. See RD Dashboards.

Widgets are under Configuration › Reporting Dashboard › Widgets. The list shows each widget's Name, Owner, Created Date and Modified Date, with a search box, a refresh button and New Widget.

The Widgets list

System Widgets

D3 provides ready-made widgets, owned by System. On the instance used for this article, they included:

System widgets
All Events	Mean Time to Resolve By Owner
All Incidents	Open Event Count By Investigator & Severity
Average Detect Time	Open Incident Count By Owner & Severity
Average Resolve Time	Resolved Incidents Count By Day
Closed Incidents Count By Date	Top 10 Average Detect Time By Incident Type
Closed Incidents Count By Date & Owner	Top 10 Event Count By High-risk Artifact Name
Closed Incidents Count By Incident Type & Month	Top 10 Event Count by Integration
Closed Incidents Count By Month	Top 10 Incident Count By High-risk Artifact Name
Critical Incident Count By Owner	Top 10 Tactics & Techniques in Incident
Critical Incidents Count By Closed By	Top 50 Long Running Incidents
Daily Event Count By Event Status	Total Dismissed Events Count By Day
Daily Incident Count By Incident Status	Total Event Count
Detect Time By Day	Total Event Count By Day
Event Count By Artifact Name	Total Event Count By Day & Event Integration
Event Count By Dismiss Reason	Total Event Count By Day & Event Type
Event Count By Severity	Total Event Count By Event Integration & Month
Event Count By Status	Total Event Count By Event Integration & Severity
Event Count By Tactic & Technique	Total Event Ingestion Count By Day
Event Detect Time By Severity	Total Incident Count
Incident Count By Artifact Name	Total Incident Count By Day
Incident Count By Severity	Total Incident Count By Day & Incident Type
Mean Time to Detect By Incident Type	Total Incident Count By Incident Type
Mean Time to Resolve By Incident Type	Total Incident Count By Incident Type & Month

A widget takes its data from a saved query. To build or change queries, see Reporting Queries.

Go to Configuration › Reporting Dashboard › Widgets, then select New Widget.
Select the pencil icon next to New Widget and enter a name.
Under Widget type, select Select a chart type, then choose a type in the Select a Widget window (see Widget Types below).
Under Query, select Select a query, then choose a query under Use a Saved Query. To build a new query, select Create New Query. To change the selected query, select Edit Query.
Complete the fields that the widget type asks for, such as Group By and Aggregation (see Widget Fields below).
Optionally, set the Widget Options on the right (see Widget Options below).
Select Save.

Choosing a widget type

The Select a Widget window with the Charts, Series Charts, Table and Others groups

Choosing a saved query

The Use a Saved Query window listing queries with their Name, Owner, Created Date and Modified Date

A widget being configured

Data Source shows the data type of the selected query, for reference only. To use a different data source, select a different query. Below the fields, Query Data lists the query's records and Results lists the aggregated values that the widget draws.

On the right, a preview of the widget is drawn as you go. Date range shows the query's date range. Turn on Override to give this widget its own range. The range can also be changed on the dashboard.

The widget is saved and stays open, with Permissions and More actions (...) at the top right.

Group	Widget types
Charts	Line, Bar, Column, Pie, Line & Median, Donut
Series Charts	Multi Line, Stacked Column, Grouped Column, Stacked Bar, Grouped Bar, Stacked Area, Sankey
Table	Data Table (not available in the Email Scheduler)
Others	Numbers, HTML, List, Summary

The fields depend on the widget type. Each field shows its own help text in the editor.

Field	What it sets	Widget types
Group By	The category of data plotted on the main axis. For example, in a chart of incidents over time, the count of incidents is grouped by date.	Line, Bar, Column and the series charts
Secondary Group By	A second category plotted along the main axis. For example, in a chart that compares high and low severity incidents over time, the secondary group by is severity.	Multi Line, Stacked Column, Grouped Column, Stacked Bar, Grouped Bar, Stacked Area, Sankey
Aggregation	The summary of the raw data points: count, average, summation, maximum or minimum. For example, a count aggregation on incidents returns the total number of incidents.	Line, Bar, Column, the series charts, Numbers, HTML
Colour Field	The category shown as sections. For example, in a chart of incident types, the colour field is the incident type.	Pie, Donut
Angular Field	The category to aggregate. For example, in a chart of incident types, the angular field is the proportion of each type.	Pie, Donut
HTML Template	Custom HTML to render for each result. Use `{{AggregatedResult}}` for the aggregated value, for example `Total is {{AggregatedResult}}.`	HTML
Primary Field	The field shown as the primary text of each list item.	List
Secondary Field	The field shown as the secondary text of each list item.	List

A Data Table widget shows the query's records as a table. A Summary widget has no fields to set.

Option	What it sets	Widget types
X-axis Label, Y-axis Label	A switch and a text box for each axis label.	Line & Median, Multi Line
Maximum Results	The largest number of aggregated results drawn (5 by default).	Line & Median, Multi Line, Pie, List
Sort Order	Not sorted or a field to sort by, and a direction (Descending by default). A Data Table offers Default order and a direction.	Line & Median, Multi Line, Pie, List, Data Table
Tags	Tags for organizing widgets. The dashboard editor's widget panel filters by tag.	All
Filterable Columns (max 3)	Up to three columns.	Line & Median, Multi Line, Pie, List, HTML
Unit	The unit shown with the number.	Numbers

On a saved widget you own, select Permissions. The window works like the dashboard permissions window: add sites on Add Site(s) or users on Add User(s), select Add, then set the access levels. See RD Dashboards.

This widget shows the number of incidents created each day, split by severity.

Select New Widget and name the widget.
Under Widget type, choose Multi Line.
Under Query, choose All Incidents.
Set Group By to Incident Created Utc Time (YYYY-MM-DD) and Secondary Group By to Incident Severity. Leave Aggregation at COUNT.
Under Widget Options, turn on Y-axis Label and enter a label, and set Maximum Results.
Select Save.

The preview draws one line for each severity, with a legend at the top.

The example widget on a dashboard

On a widget you own, select More actions (...) › Clone.
On a widget that you do not own, such as a system widget, select Clone at the top right.

Enter the Widget Name of the copy in the Clone Widget window, then select Clone.

More actions on your own widget

The More actions menu of a widget with Clone and Delete

Clone on a system widget

The Clone button at the top right of a system widget

Clone Widget

On a widget you own, select More actions (...) › Delete, then Delete in the confirmation. Deleting cannot be undone.

Overview

System Widgets

Creating a Widget

Widget Types

Widget Fields

Widget Options

Widget Permissions

Widget Example: Incident Volume by Severity

Cloning a Widget

Deleting a Widget