DashboardDashboards Guide

You can filter the dashboard by time range, platform, host, user, and alert type. To manage filters:

This single value bar chart displays the total number of Microsoft 365 events that have been triggered over the selected time range.

This pie chart illustrates the count proportions of the top 10 Microsoft 365 activity types. To view the represented values, hover your pointer over the graph slices. To view the underlying events of a value, click the graph slice, and then click Show Results in Search.

This bar chart displays the success/fail outcome counts of the top 10 most common activities. To view the values represented in the bars, hover your pointer over the bar segments. To view the underlying events of a value, click the bar segment, and then click Show Results in Search.

This pie chart illustrates the count proportions of the top 10 most active source hosts. To view the represented values, hover your pointer over the graph slices. To view the underlying events of a value, click the bar, and then click Show Results in Search.

This column chart breaks down the counts of the top 10 most frequent activity types by the users who are triggering them. To view the values represented in the chart and user information, move your pointer over the column segments. To view the underlying events of a value, click the column segment, and then click Show Results in Search.

This bar chart breaks down the counts of the top 10 most common alert types by the alert names that are grouped within them. To view the values represented in the chart, move your pointer over the bar segments. To view the underlying events of a value, click the bar segment, and then click Show Results in Search.

This line chart shows the count trends of the different alert severities by log hours. To view the values represented in the chart, move your pointer over the graph lines and hover on the data points. To view the underlying events of a value, click the data point, and then click Show Results in Search.

This Sankey chart displays the counts of the top 10 most common alert types and breaks them down by log hour. The left side of the chart shows the total counts of the different alert types, and the right side breaks them down by log hour. To highlight the links between the alert types and log hours and view their count values, move your pointer over the links. To view the underlying events of a value, click the link, and then click Show Results in Search.

This column chart breaks down the activity counts of the top 10 most accessed objects by their log hours. To view the values represented on the chart, hover your pointer over the bar segments. To view the underlying events of a value, click the bar segment, and then click Show Results in Search.

This heat map breaks down file activity counts by activity type and file. Darker shading on the map indicates a greater number of events. To view the underlying events of a value, click the square, and then click Show Results in Search.

This bar chart displays the success/fail counts of file access events. To view the values represented in the bars, hover your pointer over their segments.

This Sankey chart breaks down failed app activities by log hour. The left side of the chart shows the total failed app activities count, and the right side breaks them down by log hour. To highlight the links between activity and log hours and view their count values, hover your pointer over the links. To view the underlying events of a value, click the link, and then click Show Results in Search.

This bar chart displays the activity and login counts of the top 10 users with the most failed app activities. To view the values represented in the bars, hover your pointer over them.

This Sankey chart breaks down the event counts of the different application failure reasons by log hours. The left side of the chart shows the failure reason counts; the right side shows the log hours during which the events were triggered and their combined event counts. To highlight the links between the failure reasons and log hours and view their count values, hover your pointer over the links. To view the underlying events of a value, click the link, and then click Show Results in Search.

This pie chart shows the total count of app login events, and illustrates the count proportions of success and failure outcomes. To view the represented values, hover your pointer over the graph slices. To view the underlying events of a value, click the graph slice, and then click Show Results in Search.

This Sankey chart breaks down the counts of the top 10 users with the most failed app logins by log hours. The left side of the chart shows the users and their failed login counts; the right side shows the log hours during which the events were triggered and their combined event counts. To highlight the links between the users and log hours and view their count values, hover your pointer over the links.

This table provides event details on the failed app logins that have been triggered for each user. Click the heading of the column that you want to sort the data by. Click the arrow icon to change between ascending and descending orders. To view all the table rows, you may need to use the scroll bar on the right.

To drill down into an entry and view the events, click the count value, and then click Show Results in Search.