DashboardDashboards Guide

This bar chart represents the volume of activity by users with privileged account access in your organization. It can help you monitor and investigate anomalous behavior in those accounts. To view information in the chart, move your pointer over the bar segments to display the values they represent. To drill into the underlying events, click the bar and then click Show Results in Search.

This column chart displays the activity of users who have access to network control systems and configuration files in your organization. It can help you monitor and investigate unfamiliar users who should not have access to these security controls.

To view the information in the chart, move your pointer over the column segments to display the values they represent. To drill down into a segment and view the underlying events, click the column and then click Show Results in Search.

This bar chart represents the volume of activity by users who have access to shared accounts in your organization. It can help you monitor and investigate anomalous levels of activity in those accounts to ensure that shared account usage is limited. To view the information in the chart, move your pointer over the bar segments to display the values they represent. To drill into the underlying events, click a bar and then click Show Results in Search.

This bar chart represents the volume of third-party activity in your organization. It can help you monitor and investigate unexpected third-party access and activity. To view the information in the chart, move your pointer over the bar segments to display the values they represent. To drill into the underlying events, click the bar and then click Show Results in Search.

This column chart displays the activity of users who have elevated privileges in your organization. It can help you monitor, investigate, and retain audit logs that indicate anomalous levels of activity by users with elevated privileges.

To view the information in the chart, move your pointer over the column segments to display the values they represent. To drill down into a segment and view the underlying events, click the column and then click Show Results in Search.

This bar chart represents the volume of physical access activity into sensitive in-scope data environments in your organization. It can help you monitor and investigate access activities to these environments.

To view the information in the chart, move your pointer over the bar segments to display the values they represent. To drill into the underlying events, click the bar and then click Show Results in Search.

This column chart displays the volume of configuration activity in your organization. It can help you monitor and investigate, unexpected levels of create, delete, and modify activity in critical files and system-level objects. These activities can indicate a compromise to system security.

To view the information in the chart, move your pointer over the column segments to display the values they represent. To drill down into a segment and view the underlying events, click the column and then click Show Results in Search.

This bar chart represents the volume of activity in system and service accounts that require privileged access in your organization. It can help you monitor and investigate anomalous levels of activity in those accounts to ensure that access to those accounts is limited. To view the information in the chart, move your pointer over the bar segments to display the values they represen

To drill into the underlying events, click the bar and then click Show Results in Search.

This bar chart represents rule trigger activity by users in your organization. It can help you verify that appropriate security monitoring (for intrusion detection and prevention) and alerts are in place. You can use this chart to monitor and investigate anomalous levels of rule trigger activity that could indicate a security compromise.

To view the information in the chart, move your pointer over the bar segments to display the values they represent. To drill into the underlying events, click the bar and then click Show Results in Search.

This Sankey chart breaks down the event counts for different host accounts and for security protocols (TCP, UDP, HTTPS), and illustrates the connections between them. The left side of the chart shows the host counts and the right side shows the protocol counts. This chart can help you monitor for unapproved activity in firewall services, protocols, and ports. It can be used to confirm that traffic and behavior matches expected activity. Firewall activity should be related to defined and approved business needs.

To highlight the links between the hosts and the protocols and view their count values, move your pointer over the lines that link them. To view the underlying events of a value, click the line, and then click Show Results in Search.

This pie chart illustrates the count proportions of which host accounts are making firewall configuration changes in your organization. It can help you monitor and investigate unusual change activity in your firewall configurations. These changes should be managed via a change control process.

To view the information in the chart, move your pointer over the graph slices to display the values they represent. To view the underlying events of a value, click the graph slice and then click Show Results in Search.

This area chart represents the count trends of different malware-related activities by users in your organization over time. It can provide anti-malware insights to help you scan, detect, block, and remove known malware.

To view the information in the chart, move your pointer over a graph area to display the data points and their represented values. To view the underlying events of a value, click a data point, and then click Show Results in Search.