Dashboard concepts

Mach5 dashboards are persistent, namespaced resources made of query-backed panels on a grid canvas. Dashboards can be created manually, promoted from AI investigation, packaged in apps, or generated by automation.

Use dashboards when a team needs a durable view of operational data: summaries, trends, timelines, ranked lists, tables, maps, agent activity, or investigation evidence.

Dashboard structure

A dashboard has these top-level parts:

A minimal dashboard contains a description, layout, and at least one panel.

{
  "description": "Security operations overview",
  "tags": ["security", "operations"],
  "refresh": {
    "enabled": true,
    "interval_seconds": 60
  },
  "layout": {
    "columns": 24,
    "row_height": 30
  },
  "panels": []
}

Sources

The source field describes where the dashboard came from.

{
  "source": {
    "origin": "app",
    "app_id": "agent-runtime-attribution"
  }
}

Promoted dashboards can preserve the investigation context:

{
  "source": {
    "origin": "promoted",
    "promoted_from": {
      "session_id": "sess_01J...",
      "turn_id": "turn_07"
    }
  }
}

Refresh

Refresh controls how often the dashboard updates while open.

{
  "refresh": {
    "enabled": true,
    "interval_seconds": 30
  }
}

Use shorter refresh intervals for live operations. Use longer intervals for expensive queries or historical dashboards.

Panels can override the dashboard refresh interval with refresh_override_seconds.

Time range

Dashboards can define a shared time range.

Relative time range:

{
  "time_range": {
    "mode": "relative",
    "value": 24,
    "unit": "hours"
  }
}

Absolute time range:

{
  "time_range": {
    "mode": "absolute",
    "from_epoch_ms": 1735689600000,
    "to_epoch_ms": 1735776000000
  }
}

Supported relative units are minutes, hours, days, and weeks.

Parameters and filters

Parameters are shared dashboard inputs. They power filters, panel query placeholders, drilldowns, and cross-filtering.

Supported parameter types:

Static select parameter:

{
  "name": "severity",
  "display_name": "Severity",
  "type": "select",
  "default_value": "high",
  "required": false,
  "config": {
    "kind": "select",
    "options": [
      { "value": "critical", "label": "Critical" },
      { "value": "high", "label": "High" },
      { "value": "medium", "label": "Medium" }
    ],
    "allow_custom": false
  }
}

Query-backed select parameter:

{
  "name": "service",
  "display_name": "Service",
  "type": "select",
  "config": {
    "kind": "select",
    "query": {
      "sql": "SELECT DISTINCT service AS value FROM runtime_events ORDER BY service",
      "value_column": "value",
      "label_column": "value",
      "refresh_on_dashboard_open": true
    }
  }
}

Number parameter:

{
  "name": "min_risk",
  "display_name": "Minimum risk",
  "type": "number",
  "default_value": "70",
  "config": {
    "kind": "number",
    "min": 0,
    "max": 100,
    "step": 5
  }
}

Text parameter:

{
  "name": "user_search",
  "display_name": "User search",
  "type": "text",
  "config": {
    "kind": "text",
    "placeholder": "alice@example.com"
  }
}

Layout

Dashboards use a grid layout. The default is 24 columns with a row height of 30 pixels.

{
  "layout": {
    "columns": 24,
    "row_height": 30,
    "tabs": [
      {
        "name": "Overview",
        "panel_ids": ["p_total_findings", "p_findings_over_time"]
      },
      {
        "name": "Evidence",
        "panel_ids": ["p_recent_events", "p_process_tree"]
      }
    ]
  }
}

Each panel defines its own position:

{
  "grid_pos": {
    "x": 0,
    "y": 0,
    "w": 8,
    "h": 4
  }
}

Panels

A panel combines a query, visualization, grid position, and optional interactions.

{
  "id": "p_total_findings",
  "title": "Total findings",
  "grid_pos": { "x": 0, "y": 0, "w": 6, "h": 4 },
  "query": {
    "source": {
      "type": "sql",
      "sql": "SELECT COUNT(*) AS total FROM findings WHERE severity = {{severity}}"
    },
    "parameter_bindings": [
      {
        "parameter_name": "severity",
        "query_placeholder": "{{severity}}"
      }
    ]
  },
  "visualization": {
    "type": "metric_card",
    "emphasis": "hero",
    "config": {
      "value_column": "total"
    }
  }
}

Query sources

Panels can query data through several sources.

Visualizations

Supported visualization types include:

• auto
• data_table
• time_chart
• column_chart
• area_chart
• pie_chart
• metric_card
• level_chart
• map
• process_tree
• network_graph
• timeline
• summary
• ranked_list
• agent_run_list
• command_evidence_list
• sensitive_command_catalog
• log_source_coverage
• network_flow_list

Visualization emphasis controls sizing and prominence:

Common visualization config fields:

Interactions

Interactions make dashboards active. A panel can cross-filter another panel, open an investigation, navigate to another dashboard, or open an external URL.

Supported triggers:

Supported actions:

Example cross-filter:

{
  "trigger": {
    "type": "select",
    "column": "service"
  },
  "action": {
    "type": "cross_filter",
    "target_parameter": "service",
    "value_from": "service"
  }
}

For full configuration examples, see Dashboard configuration.