Skip to main content

DashboardDashboards Guide

Anomalies Dashboard

The Anomalies dashboard features three visualizations: Anomalies by use case, Anomalies count over time, and Anomalies by rule name.

Dashboard Filters

You can filter the dashboard visualizations by incident creation times, rule names, and risk scores.

To set the filters:

  1. Click the drop-down icon on the right.

    Anomalies-Dropdown-Icon.png

  2. Do any of the following:

    • To set the Incident Creation Time filter, select an operator from the first drop-down menu, and then enter or select values in the adjacent fields to complete the filter phrase.

      Incident-Creation-Time.png

      To add an additional filter phrase, click the plus icon.

      Dash-Filter-Plus-Icon.png

      Note

      The default setting for Incident Creation Time is in the last seven days.

    • To set the Rule Name filter, select an operator from the first drop-down menu, and then enter a rule name in the field on the right. To add an additional filter phrase, click the plus icon Filter-Plus-Icon.png .

      Rule-Name-Filter.png

      To add an additional filter phrase, click the plus icon and complete the fields as needed.

    • To set the Score filter, drag the handles at the ends of the slider bar to set a score range.

      Score-Filter.png

  3. Click Apply.

    The updated filter is applied to the visualizations.

Anomalies by Use Case

This heat map breaks down the number of anomalies by use case over the selected time range. Darker shading indicates a greater number of use cases. To drill down into a graph value and get a list of the represented entities and their respective counts, click the graph square, and then click Show All [n].

Heatmap-Show-All.png

Anomalies Count Over Time

This area chart represents the count changes of the different anomaly types over the selected time range. Move your pointer over a graph area to highlight it and display the data points, which you can then click to view their count values and drill down into the data. To view the individual entities represented and their creation times, click the anomaly's count value, and then click Show All [n].

Anomalies-Count-Over-Time.png

Anomalies by Rule Name

This table breaks down the anomalies by rule name. It shows the number of anomalies per rule name, and provides details on the following: Rule ID, rule reason, score, use case, and MITRE tag. To drill down into a rule name and display the entities represented and their creation times, click the count value, and then click Show All [n].

Anomalies-By-Rule-Name.png