Datasets
Underlying a card is a query against a dataset. Lacework Edge makes various datasets available, which you can use in your own custom cards. The datasets include information having to do with logs, users, events, and more. Essentially all the data you can find in Lacework Edge is available by a dataset.
The specific data available to you varies depending on your configuration. You should explore datasets in the card creator UI for a definitive list for you, but the following are a few important example datasets:
- Admin logs: Data pertaining to activity, such as configuration changes, in the Lacework Edge admin console.
- Events: User activity events, such as logging in or logging out, running a new executable, using a new device, and more.
- User Risk Scores: For each user, this data reflects the risk level for the user across several parameters, including document behavior, location behavior, device posture, access posture, and more.
- Edge App Usage: User access information for connected applications.
- All Alerts: All open alerts in Lacework Edge.
To explore the datasets that are available to you, when creating or editing a cards, expand the Dataset menu to see what's available.
To choose a dataset manually, you need to choose the raw options approach to creating a card. For details, see Cards.