Requirements

You will need the following to start building your Lumu reports with Google Data Studio.

• A Lumu Defender subscription to collect your Lumu Defender API key.
• A Google account with access to Google Data Studio.
• The Lumu Data Studio template.

While we provide this template as a robust starting point, maximizing its potential requires familiarity with Data Studio's core mechanics. For general guidance, we highly recommend utilizing the official Google Data Studio Help Center.

Collect your Lumu Defender API key

Follow the steps outlined in the Access and Authentication section of the Defender API: Features, Functionality, and Usage document. Ensure you copy the key and store it for later use.

Access the Data Studio Connector / Report

1. Go to this link to access the Lumu Data Studio Template.

2. Access your Google account with Data Studio access and authorize the connector when prompted.

3. Fill in the connector parameters as follows:

• Lumu Defender API Key: Paste the key collected in the step above.
• Data Lookback Period (Days): Enter the number of days starting from today to collect incident data.
• Hourly Analyst Rate (USD): Type in the average hourly labor cost. If the exact figure is unknown, use the highest estimate available to ensure conservative ROI calculations.
• Manual Average Time to Respond per Incident (minutes): Enter the average hands-on labor time an analyst spends manually investigating and responding to a single incident. This value is used to calculate ROI and efficiency measures.
• Check the Use report template for new reports option.
• Click Connect when finished.

4. After a short loading screen, you will see all the dimensions to be included in the report. Click on Create Report to continue.

Data Studio will begin loading your report once the data source is confirmed. Depending on the volume of Lumu incidents in your organization for the requested time range, initial data loading may take up to a few minutes.

When the report template loads, you will arrive at the report overview.

This page informs you about the state of the data loading process. You can find the following states:

• Completed: All the data has been loaded into the report template.
• Partial: The data is still being loaded. You can still use the report under this status; however, the report won’t show all the information of your organization until the loading is complete.

If a timeout occurs, try loading the report again. If the problem persists, try fetching a smaller data set by selecting a lower number of days to collect the data.

Lumu's Executive Report

Make sure you use View mode when consulting the report to avoid misconfigurations.

Lumu's executive report is a purpose-built template that provides actionable business intelligence. By centralizing incident data, adversary types, and operational efficiency metrics, this template helps you evaluate how effectively your organization is identifying and neutralizing threats.

The template displays an overview of your data across three main sections:

• Primary metrics: Data at the top of the report showcases the value provided by your security operations.
• Activity trend distribution of new incidents: Incident data from the collected period based on the provided date range.
• Operational data: Adds context on open incidents that fall outside the provided date range.

Driving Measurable Outcomes

The Executive Report is designed to surface the core essentials for modern security reporting:

• Quantifying Return on Investment (ROI): By displaying Operational Time Saved by Automation and Operational Cost Savings, your organization can quantify how many hours and dollars are saved through automation — providing tangible evidence of the financial value of the security program.
• Measuring Response Velocity: Metrics like Mean Time to Respond (MTTR) and Triggered Incidents / Automated Responses over time allow your organization to track response speed and showcase the value of Lumu's Automated Response mechanisms.
• Strategic Risk Prioritization: Visuals like Business Relevance Distribution and Incident Operations per Adversary Type help demonstrate how security teams have focused effort on the most critical incidents.
• Operational Health: Data about Incident Closure Rate and Open Incidents helps measure whether the security team is efficiently resolving incidents, and can inform decisions about headcount or additional automation tooling.
• Threat Landscape: Clear information about your organization's Threat Type Distribution and Top Affected Entities enables targeted hardening of the most vulnerable or highly-targeted segments of your network.

Create Your Own Report

The Lumu Data Studio template is designed for versatility. It provides a library of pre-built chart components — from high-level financial summaries for executives to granular incident data for analysts — that you can mix, match, and extend.

Depending on your objectives, you can build reports such as:

• The Daily SOC Stand-up: Focused on tactical awareness and immediate workload. Recommended visuals: Open Incidents, Top Affected Entities, Incidents by Status, and Incident Closure Rate.
• Quarterly Board Review: Focused on financial justification and high-level risk trends. Recommended visuals: Operational Cost Savings, Business Relevance Distribution, Mean Time to Detect (MTTD), and Autopilot Closure Rate.
• Asset Hygiene & IT Health: Focused on identifying weak points in your organization's infrastructure. Recommended visuals: Incidents by Label, Top Affected Entities, and Network / Behavior Incidents over time.

Add Your Own Charts

Data Studio's drag-and-drop interface allows you to add new chart types by clicking Add a chart in the toolbar menu. Connect any chart to the Lumu data source already configured in the template, then drag the desired fields from the Available Fields panel into the chart's Dimension and Metric slots.

You can also blend the Lumu data source with other data sources (such as Google Sheets or BigQuery) using Data Studio's Data Blending feature to create unified security dashboards that combine Lumu incident data with data from other tools in your cybersecurity stack.

The following elements represent the report's established Bends. You are encouraged to incorporate additional Bends as necessary; however, please refrain from deleting or altering the existing configurations unless you possess a comprehensive understanding of their functionality.

Connector Limitations

The built-in community connector is subject to Google platform constraints that can affect report performance:

• Data Studio Rendering Timeout: Each chart has a ~240-second rendering window. If the data query exceeds this, the chart will fail to display. Mitigation: Use shorter lookback periods (30–60 days) to keep data volumes manageable.
• Apps Script Execution Limits: Script runs are limited to 6 minutes (consumer) or 30 minutes (Workspace). Large pulls may time out mid-execution. Mitigation: Use report-level filters to slice data after loading or upgrade to the Extract Data Connector.

Using Google’s Extract Data for Better Performance

For larger environments, Google Data Studio's Extract Data connector can significantly improve the dashboard performance. Extract Data creates a static snapshot of your data, enabling rapid chart visualization by serving data from cached storage rather than executing live API queries. The main advantages of using Google’s Extract Data Connector are:

• Enhanced Rendering Speed: Visualizations load faster from the cached snapshot, significantly reducing latency and improving overall dashboard responsiveness.
• Timeout Mitigation: Bypasses live API rendering constraints (approx. 240 seconds) and Apps Script execution limits, ensuring consistent report performance for complex data sets.
• Operational Optimization: Reduces the frequency of live API calls to Lumu, lowering the probability of rate-limiting or connection errors.
• Fluid Interactions: Enables highly responsive filter applications and page transitions by eliminating repeated real-time data fetching.

This approach is recommended for environments with large datasets or dashboards containing many visualizations.

Configuration Steps

1. In Data Studio, click on Add Data in the toolbar menu, and look for Extract Data in the connector gallery.

2. Designate your active Lumu data connector as the source for the extraction.

3. Drag all dimensions and metrics from the Available Fields panel into the target area to maintain the dataset size within the 100 MB limit.

4. Additionally, you can apply specific data filters and date ranges to further minimize the dataset size (limit: 750,000 rows).

5. In the right configuration panel, enable Auto update and define a refresh frequency (e.g., Daily or Hourly) to ensure your report data remains current.

6. Then, Click Save and Extract to generate the static dataset. You may then add this newly created data source to your report, replacing the live connector.

Extracted data is static and not real-time. Please ensure your chosen refresh schedule aligns with your organizational reporting requirements.

Upon confirmation of the Extract Data connector, it is the user's responsibility to apply this data source across all Bends, Filters, and Charts. Although this process may be labor-intensive, it ensures a consistent configuration for future use.

Further Steps

After connecting your data, optimize and extend your report:

• Optimize Performance: Use Extract Data sources and schedule regular report refreshes.
• Customize & Scale: Tailor dashboards to operational needs and create department-specific views.
• Automate Reporting: Schedule recurring email deliveries of PDF summaries for leadership via the Share menu.
• Enhance Insights: Use 'Blend Data' to map Lumu IP findings against internal asset inventories or identity provider logs.
• Share & Embed: Grant access via Google Workspace permissions, embed reports in internal portals, or integrate Lumu widgets into existing dashboards.
• Production Readiness: Use the Extract Data Connector to ensure reliability in production environments.