- Dashboards
- Navigation Overview
- View and Interact with Dashboards
- View and Interact with Visualizations
- User Management
- Configure and Manage Dashboards
- Create a Dashboard
- Add a Visualization to a Dashboard
- Add a Text Tile
- Modify a Dashboard Layout
- Add Dashboard Filters
- Manage Automatic Refresh Rates
- Create a Scheduled Delivery
- Make a Dashboard Public
- Export and Import Dashboards
- Edit Dashboard Filters
- Edit Dashboard Details
- Duplicate a Dashboard
- Delete a Dashboard
- Configure and Manage Visualizations
- Create a Visualization
- Auto-Create a Visualization from a Natural Language Prompt
- Add Visualizations from the Library to a Dashboard
- Create a Visualization from a Search Query
- Modify a Visualization
- Configure Visualization Query Filters
- Include Context Filtering in Visualizations
- Make a Visualization Public
- Export and Import Visualizations
- Duplicate a Visualization
- Remove a Visualization from a Dashboard
- Delete Visualizations from the Library
- Pre-Built Dashboards
- Advanced Analytics
- Threat Center
- Case Manager
- Compliance / Event Store
- Access Grant and Revoke Activity Dashboard
- Account Logout Summary Dashboard
- Account Management Activity Dashboard
- Application Security Event Summary Dashboard
- Authenticated User Accounts on Hosts Dashboard
- AWS CloudTrail Summary Dashboard
- Data Loss Prevention Activity Dashboard – Host-Based
- Data Loss Prevention Activity Dashboard – User-Based
- Data Loss Prevention Activity Summary Dashboard
- Default Account Access Dashboard
- Default Credential Usage and Change Activity Dashboard
- Denied Web Access Activity Dashboard
- Disabled User Account Summary Dashboard
- Discovered Attacks by Source and Destination Dashboard
- Endpoint Detection and Response Dashboard
- Failed Application Logon Activity Dashboard
- Failed Audit Logs Summary Dashboard
- Failed Host Login Attempt Counts by Users Dashboard
- Failed VPN Login Attempts and Remote Session Timeouts Dashboard
- Firewall Activity Dashboard
- Firewall and Router Device Interfaces Dashboard
- Indicator of Compromise (IOC) Statistics Dashboard
- Insecure Authentication Attempts Dashboard
- Microsoft 365 Summary Dashboard
- Microsoft Windows Overview Dashboard
- Network Applications by Traffic Volume Dashboard
- Policy Activity Summary Dashboard
- Port Usage Trends Dashboard
- Privileged Access Dashboard
- Privileged Access Dashboard – User-Based
- Protocols by Network Traffic Dashboard
- Remote Session Overview Dashboard
- Security Alert Summary Dashboard – Impacted Hosts
- Security Alert Summary Dashboard – Origin Hosts
- Security Alert Summary Dashboard – Users
- Successful Application Logon Activity Dashboard
- Successful Database Login Activity Dashboard
- Successful Physical Access Dashboard
- Top Attackers Dashboard
- User Account Creation Summary Dashboard
- User Account Lockout Activity Dashboard
- Vendor Authentication Activity Dashboard
- Windows Audit Failure Summary by Hosts Dashboard
- Windows Audit Failure Summary by Users Dashboard
- Windows User Privilege Elevation Dashboard
- Zscaler HTTP Dashboard
- Correlation Rules
- SOC Management
- Pre-Built Visualizations
- Anomalies - Use Case & MITRE Coverage
- Anomalies by Rule Name
- Anomalies by Use Case
- Anomalies Count Over Time
- Anomaly Distribution by MITRE Tactic & Score
- Application Count
- Closed Incidents
- Correlation Rules by Severity
- Correlation Rules Triggered Over Time
- Detected Anomalies
- Host-Based DLP Alerts Count
- Incidents Created
- Incident Summary by Incident Type
- Number of Hosts with DLP Alerts
- SOC Incident Distribution
- Top 5 Host-Based DLP Alert Categories
- Top 5 Protocols in Host-Based DLP Alerts
- Top 10 Host-Based DLP Alert Types
- Top 10 Hosts with DLP Alerts
- Top Activities per Top 10 Applications
- Top Users per Top 10 Applications
- Trend of Application Security Events
Navigate the Visualizations Tab
The Visualizations tab provides single-pane access to a library of reusable visualizations in your system. The library contains any dashboards that were either created from the Visualizations tab, or were created in a dashboard but then explicitly added to the library. Visualizations in the library are reusable, and can be used in multiple dashboards.
By default, when the Visualizations tab is displayed, it opens in the Favorites view and shows only those visualizations you have marked as favorites. If you have not yet marked any visualizations as favorites, the Visualizations tab opens in the All view and shows all of the existing visualizations.
The Visualizations tab includes five main sections, as shown in the following image and described in the numbered points below.
Use the Dashboards and Visualizations tabs to toggle the homepage display between dashboards and visualizations.
In the area under the tabs, you can:
Use the Search field to quickly locate specific visualizations. Search by visualization names.
Click New Visualization to start creating a new visualization from scratch. For more information, see Create a Visualization.
Click Import to import external visualizations that were saved as a
.configfiles. For more information, see Import Visualizations.
The area beneath the Search field provides multiple ways to sort, filter, and view the currently displayed set of visualizations. From left to right, it provides the following options:
# Visualizations – Indicates how many visualizations are currently displayed. The number changes as you search or filter the visualizations.
Created by – Filter the display to show only visualizations created by one or more specific creators. You can also opt to display only Exabeam out-of-the-box visualizations or all custom visualizations.
Chart type – Filter the display to show only a specific type of visualizations, based on the chart type it includes. Options include, Area Chart, Bar Chart, Bubble Chart, Column Chart, Coverage Map, Funnel, Heat Map, Line Graph, Map, Pie/Donut, Sankey, Single Value, Table, Word Cloud.
Sort by: – Select a sort option for the displayed visualizations. Options include sorting by create or update dates, by creator name, and by dashboard name.
List/Tile Selector – Toggle the display between the list view and the tile view. The list view is the default. All of the other filter and sort options apply to both the list and tile views.Cancel/Export/Delete – When you hover your pointer over a specific visualization in the list or tile view and select the checkbox for that visualization, an additional set of options are displayed to the left of the filter and sort options. These include options to Cancel, Export, or Delete the selected visualization. You can select multiple visualizations to perform these actions in bulk.
In the left navigation panel, you can organize your visualizations into a folder structure. This folder structure provides an easy way to group, store, and access individual visualizations. The following types of folders are included:
All – Displays all of the existing visualizations, including visualizations in all of the other folders. This is the default display.
Favorites – Displays only the visualizations marked as favorites. To mark a visualization as a favorite, click the favorite icon (
). It's on the far right of a visualization row in the list view and on the top right of the visualization tile in the tile view.My Visualizations – Displays only the visualizations you have created.
Drafts – Displays only the visualizations that you have created but have not published. These visualizations are marked with a Draft tag next to the visualization name. They are visible only to the creator.
Custom Folders – Create and name your own folders where you can group visualizations according to your own hierarchy. When you hover over a custom folder, an options menu icon (
) is displayed. Click to display the menu where you can choose to Rename, Copy link, or Delete a specific custom folder. You can also take the following actions with custom folders:To create a new custom folder, hover over the Custom Folder heading and click the add icon. Enter a name for the new folder.
Note
A total of 50 custom folders, across all users in your deployment, can be created for visualizations.
To assign a visualization to a custom folder, click the options menu (
) for a specific visualization and select Add to folder.To remove a visualization from a custom folder, click the folder to display the visualizations it contains. Then click the options menu (
) for a specific visualization and select Remove from this folder.
The list or tile panel on the right shows the set of visualizations currently displayed and provides access to the displayed visualizations. Each visualization is shown with an icon that shows the type of chart it contains, its name, who created it, and the date it was last updated. You can interact with individual visualizations in the following ways:
Click a visualization to open it for viewing or editing.
Hover over a visualization to display a checkbox that can be used to select the visualization for actions from the menu at the top, including Cancel, Export, and Delete. For more information about these procedures, see Configure and Manage Visualizations.
Click the favorite icon (
) for a specific visualization to add it to the Favorites folder. Click the icon again to remove the visualization from Favorites.Click the options menu (
) to select additional actions for a specific visualization. Options include, Edit visualization, View details, Copy link, Add to folder, Duplicate, Export, Delete. For more information about these procedures, see Configure and Manage Visualizations.