How to change time picker for security posture dashboard in ES?

[splunky_diamond]

Hello Splunkers!

I want to change the time picker of this dashboard in Enterprise security to provide the count of notables not over the last 24 hours, but over 12 hours. 

I tried changing values related to time in the source code via GUI:

It does not work, for some reason, the changes are not being saved, even though I am hitting the save button. Is there a way to add a time picker for this dashboard, so that we can select our interested time period at any time, and update the dashboard instantly?

Thanks in advance for taking time reading and replying to my post ❤️

[gcusello]

Hi @splunky_diamond,

did you tried to go in [Configure > Incident Review]?

Surely, in this dashboard it's possible to change the time picker of the Incident Review dashboard, I'm not sure that's the same thing also for Securty Posture.

Ciao.

Giuseppe

[splunky_diamond]

Hello @gcusello , 

Thanks for replying to my post!

I am sorry, but I don't think I quite understand what you are suggesting. Just FYI, here are all the available configurations in the [Configure > All configurations]: 

I checked multiple settings, but I don't think any of them relate to a specific dashboard that I am looking to change settings for. 

Cheers,

splunky_diamond.

[gcusello]

Hi @splunky_diamond,

see in [Incident Management > Incident Review Settings]

As I said, in this form you can configure the default Time Picker for the Incident Review dashboard, see (I'm not sure!)  if the same setting is applied also to Security Posture.

Ciao.

Giuseppe

[splunky_diamond]

I checked, it does not apply to Security Posture, but I found something, we can add the time range to that dashboard: 

I just need to figure out how to bind it to my specific dashboard, and it should work!

[gcusello]

Hi @splunky_diamond ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer (eventually your last) for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉