DashboardDashboards Guide

The Event : Approx Log Time filter sets the time range for the event data. The default setting is in the last 7 days. You can update this filter with a wide range of customizable settings.

To update the time range filter, click the arrow () on the right, under the Edit button, to expand the filters panel. In the Event : Approx Log Time filter, select an operator from the first drop down menu and then enter or select values in the subsequent fields, depending on the operator you selected. To save your filter changes, click Apply on the right side of the filter panel. The updated filter is applied to the visualization.

This bar chart represents the top 10 AWS CloudTrail activity types in your organization. To view the values represented in the bars, hover your pointer over them. To view the underlying events of a value, click the bar, and then click Show Results in Search.

This area chart shows the count trends of the top 10 most common activity types. To view the count values represented in the chart, hover your pointer over the graph lines to display the data points. To view the underlying events of a count value, click the data point, and then click Show Results in Search.

This pie chart illustrates the count proportions of the top 10 most accessed hosts. To view the represented values, hover your pointer over the graph slices. To view the underlying events of a value, click the graph slice, and then click Show Results in Search.

This bar chart displays the top 10 most active objects and breaks their activity counts down by log hours. To view the represented values, hover your pointer over the bar segments. To view the underlying events of a value, click the bar segment, and then click Show Results in Search.

This bar chart displays the top 10 most active users and breaks their activity counts down by log hours. To view the represented values, hover your pointer over the bar segments. To view the underlying events of a value, click the bar segment, and then click Show Results in Search.

This column chart breaks down authentication failure reason counts by their source IP. To view the represented values, hover your pointer over the graph segments.

This table lists all the failed authentication logs. Click the heading of the column that you want to sort the data by. Click the arrow icon to change between ascending and descending orders. Use the scroll bar on the right to view all the table rows.

To view the underlying events, in the Count column, click the count value, and then click Show Results in Search.