Skip to main content

Responses are generated using AI and may contain mistakes.

DashboardDashboards Guide

Threat Center Overview

Get an overview of your Threat Center cases and how well your team is triaging and responding to them.

The dashboard is organized into two sections: Open Cases and Performance Metrics.

To view a subset of data, filter the dashboard.

Open Cases

Under Open Cases, view visualizations on cases in the New, Investigation, or Remediation stages, including:

You can use these metrics to track your team's active workload and progress as they respond to cases.

New

New is a single value-style visualization that counts the number of cases in the New stage.

Remediation

Remediation is a single value-style visualization that counts the number of cases in the Remediation stage.

Investigation

Investigation is a single value-style visualization that counts the number of cases in the Investigation stage.

Open Cases by Priority

Open Cases by Severity is a pie/donut-style visualization that counts the number of cases assigned each priority: low, medium, high, and critical. Each segment represents a given priority.

Open Cases by Assignee

The Cases by Assignee visualization is a bar chart that counts the number of cases assigned to each user. The horizontal axis represents number of cases. The vertical axis represents users.

Open Cases by Use Case

The Open Cases by Use Case visualization is a bar chart that counts the number of cases associated with each use case. The horizontal axis represents the number of cases. The vertical axis represents use cases.

Performance Metrics

Under Performance Metrics, understand your team's performance using visualizations, including:

You can use these metrics to justify headcount, prove that your team complies with service-level agreements (SLAs), and show your leadership what cases are affecting your organization and how effectively your team is responding to them.

Closed

Closed Cases is a single value-style visualization that counts the number of cases in the Closed stage.

Mean time to resolution (hours)

Mean time to resolution (hours) is a single value-style visualization that shows the average time taken to resolve cases.

The time taken to resolve a case is measured in hours from the Case Creation Timestamp Time to Case Closed Timestamp Time. Mean time to resolution is defined by the formula:

Equation 4. 
RT=h1+h2+...hnnRT=\frac{h_1+h_2+...h_n}{n}


where RT is the mean time to resolution, h is the number of hours between the Case Creation Timestamp Time to Case Closed Timestamp Time for a given case, and n is the total number of cases resolved.

Mean Dwell Time (hours)

Mean Dwell Time (hours) is a single value-style visualization that shows the average time taken to detect and respond to cases. Dwell time is measured in hours from the alert Creation Timestamp Time to the Case Creation Timestamp Time. Average dwell time is defined by the formula:

Equation 5. 
DT=h1+h2+...hnnDT=\frac{h_1+h_2+...h_n}{n}


where DT is the mean dwell time, h is the number of hours between the alert Creation Timestamp Time to event Creation Timestamp Time for a given case, and n is the total number of cases detected and responded to.

Closed Cases by Month

Closed Cases by Month is a line graph that shows the number of cases closed per month. The horizontal axis represents months. The vertical axis represents the number of cases.

Mean Time to Resolution by Month

Mean Time to Resolution by Month is a line graph that shows the average time taken to resolve cases per month. The time taken to resolve a case is measured in hours from the Case Creation Timestamp Time to Case Closed Timestamp Time. The average time to resolution is defined by the formula:

Equation 6. 
RT=h1+h2+...hnnRT=\frac{h_1+h_2+...h_n}{n}


where RT is the mean time to resolution, h is the number of hours between the Case Creation Timestamp Time to Case Closed Timestamp Time for cases resolved in a given month, and n is the total number of cases resolved that month.

The horizontal axis represents months. The vertical axis represents the average hours taken to resolve cases.

Case Closure Count by Reason

Case Closure by Reason is a column chart that shows the total number of cases closed by case closed reason. The horizontal axis represents the case closed reason. The vertical axis represents the number of cases.

Mean time to close (hours)

Mean time to close (hours) is a single value-style visualization that shows the average hours taken to close a case. Time to close is measured in hours from the alert Creation Timestamp Time to the Case Closed Timestamp Time. The average time to close is defined by the formula:

Equation 7. 
CT=h1+h2+h3+...nCT=\frac{h_1+h_2+h_3+...}{n}


where CT is the mean time to close, h is the number of hours between the alert Creation Timestamp Time and the Case Closed Timestamp Time for a given case, and n is the total number of cases closed.

Closed Case Reason by Month

Closed Case Reason by Month is a line graph that shows the number of cases closed per month for each case closed reason. Each case closed reason is represented by a different line. The horizontal axis represents the month. The vertical axis represents number of closed cases.

Case Closed Details

Case Closed Details is a table that shows up to 5000 most recently created cases and their:

  • Case Number – The unique case ID assigned to the case.

  • Creation Timestamp Time – The date and time the associated alert was created.

  • Case Creation Timestamp Time – The date and time the case was created.

  • Case Closed Timestamp Time – The date and time the case stage was changed to Closed.

  • Case Closed Reason – The pre-defined reason for why a case was closed:

    • Already mitigated/resolved – The threat has been addressed or resolved.

    • False positive or duplicate – The threat was mistakenly identified as a threat and is actually normal, non-malicious activity.

    • Low risk – The threat is insignificant or unlikely to harm the system or data.

    • Rule misconfiguration – Monitoring or detection content was misconfigured.

    • Policy or setup issue – The activity described in the case occurred because of known operations in your environment, like scheduled maintenance, authorized testing, or temporary workarounds.

    • Other – The reason for closing the case isn't covered by the other predefined reasons.

  • Time to Close – The time taken for the case to be closed. Time to close is measured in hours from the alert Creation Timestamp Time to the Case Closed Timestamp Time.

  • Time to Resolution – The time taken for the case to be resolved. The time taken to resolve a case is measured in hours from the Case Creation Timestamp Time to Case Closed Timestamp Time.

Filter the Threat Center Overview Dashboard

To view a subset of data, you can filter the dashboard by case number and when cases were created.

  1. Next to 2 Filter(s) applied, click A dark blue arrow pointing down..

  2. Filter the dashboard by case number or case creation timestamp

    1. To filter the dashboard by case number, under Alerts : Case Number, select an operator. In the text box, enter a case number, then press return or Enter.

      You can also filter for multiple case numbers:

      • To see cases that match all specified case numbers, enter the case numbers in the same text box, then press return or Enter.

      • To see cases that match any of the specified case numbers, click Filter-Plus-Icon.png Add. Select an operator, enter a case number in the text box, then press return or Enter.

    2. To filter the dashboard by case creation timestamp, under Alerts : Case Creation Timestamp Date, click the time range menu, then select a time range:

      • To select a time in the last few hours, days, months, or years, navigate to the Presets tab, then select a period.

      • To specify a range, navigate to the Custom tab, then enter specific days. To select days using a calendar, click A grey calendar..

  3. Click Apply.