A ORadar administrator creates a new saved search in QRadar and wants to add the search to a dashboard, but the option "Include in my Dashboard"…

To display saved search results as a graphical chart (e.g., bar, pie, time series) on a QRadar dashboard, the search query must contain a GROUP BY clause. If the search is not grouped, it can only be displayed as a list of results. The "Include in my Dashboard" option becomes available to create a chart-based dashboard item only when the search criteria include aggregation and grouping. While permission issues can also restrict dashboard modifications, the most direct and common reason related to the search criteria itself is the absence of a GROUP BY clause, which is a prerequisite for all graphical dashboard items.

B. The option is valid only for searches based on events.

This is incorrect. QRadar dashboards can display items based on both event data and flow data searches.

C. The option is valid only for searches based on flows.

This is incorrect. QRadar dashboards can display items based on both flow data and event data searches.

D. The user does not have sufficient permissions.

While lack of the "Dashboard" permission would prevent adding items, the question specifies an "administrator," who typically has full permissions. The more specific technical prerequisite related to the search's content is the GROUP BY clause for graphical items.

1. IBM QRadar SIEM User Guide (Version 7.5.0):

Section: "Saving search criteria"

Content: "To display the search results as a chart on the Dashboards tab, you must use a GROUP BY clause in your AQL query. If you do not use a GROUP BY clause, you can display the search results only in a table." This directly links the GROUP BY clause to the ability to create chart-based dashboard items, which is a primary function of the "Include in my Dashboard" feature.

2. IBM QRadar SIEM User Guide (Version 7.5.0):

Section: "Dashboard management"

Content: The guide details adding various items, including "Log Activity" and "Network Activity" items derived from saved searches. It implicitly and explicitly shows that graphical representations require aggregated data, for which GROUP BY is the standard mechanism in AQL. The unavailability of the option points to the search not meeting the criteria for a graphical representation.