- Dashboards
- Navigation Overview
- View and Interact with Dashboards
- View and Interact with Visualizations
- User Management
- Configure and Manage Dashboards
- Create a Dashboard
- Add a Visualization to a Dashboard
- Add a Text Tile
- Modify a Dashboard Layout
- Add Dashboard Filters
- Manage Automatic Refresh Rates
- Create a Scheduled Delivery
- Make a Dashboard Public
- Export and Import Dashboards
- Edit Dashboard Filters
- Edit Dashboard Details
- Duplicate a Dashboard
- Delete a Dashboard
- Configure and Manage Visualizations
- Create a Visualization
- Auto-Create a Visualization from a Natural Language Prompt
- Create a Visualization from a Search Query
- Add Visualizations from the Library to a Dashboard
- Modify a Visualization
- Configure Visualization Query Filters
- Include Context Filtering in Visualizations
- Make a Visualization Public
- Export and Import Visualizations
- Duplicate a Visualization
- Remove a Visualization from a Dashboard
- Delete Visualizations from the Library
- Pre-Built Dashboards
- Advanced Analytics
- Threat Center
- Case Manager
- Compliance / Event Store
- Access Grant and Revoke Activity Dashboard
- Account Logout Summary Dashboard
- Account Management Activity Dashboard
- Application Security Event Summary Dashboard
- Authenticated User Accounts on Hosts Dashboard
- AWS CloudTrail Summary Dashboard
- Data Loss Prevention Activity Dashboard – Host-Based
- Data Loss Prevention Activity Dashboard – User-Based
- Data Loss Prevention Activity Summary Dashboard
- Default Account Access Dashboard
- Default Credential Usage and Change Activity Dashboard
- Denied Web Access Activity Dashboard
- Disabled User Account Summary Dashboard
- Discovered Attacks by Source and Destination Dashboard
- Endpoint Detection and Response Dashboard
- Failed Application Logon Activity Dashboard
- Failed Audit Logs Summary Dashboard
- Failed Host Login Attempt Counts by Users Dashboard
- Failed VPN Login Attempts and Remote Session Timeouts Dashboard
- Firewall Activity Dashboard
- Firewall and Router Device Interfaces Dashboard
- Indicator of Compromise (IOC) Statistics Dashboard
- Insecure Authentication Attempts Dashboard
- Microsoft 365 Summary Dashboard
- Microsoft Windows Overview Dashboard
- Network Applications by Traffic Volume Dashboard
- Policy Activity Summary Dashboard
- Port Usage Trends Dashboard
- Privileged Access Dashboard
- Privileged Access Dashboard – User-Based
- Protocols by Network Traffic Dashboard
- Remote Session Overview Dashboard
- Security Alert Summary Dashboard – Impacted Hosts
- Security Alert Summary Dashboard – Origin Hosts
- Security Alert Summary Dashboard – Users
- Successful Application Logon Activity Dashboard
- Successful Database Login Activity Dashboard
- Successful Physical Access Dashboard
- Top Attackers Dashboard
- User Account Creation Summary Dashboard
- User Account Lockout Activity Dashboard
- Vendor Authentication Activity Dashboard
- Windows Audit Failure Summary by Hosts Dashboard
- Windows Audit Failure Summary by Users Dashboard
- Windows User Privilege Elevation Dashboard
- Zscaler HTTP Dashboard
- Correlation Rules
- SOC Management
- Pre-Built Visualizations
- Anomalies - Use Case & MITRE Coverage
- Anomalies by Rule Name
- Anomalies by Use Case
- Anomalies Count Over Time
- Anomaly Distribution by MITRE Tactic & Score
- Application Count
- Closed Incidents
- Correlation Rules by Severity
- Correlation Rules Triggered Over Time
- Detected Anomalies
- Incidents Created
- Incident Summary by Incident Type
- SOC Incident Distribution
- Top Activities per Top 10 Applications
- Top Users per Top 10 Applications
- Trend of Application Security Events
View and Interact with Visualizations
To view a specific visualization, navigate to the Visualizations tab, on the Dashboards homepage, and click on a visualization row or tile to open it.
When you have a visualization open, you can interact with it in the following ways:
Edit the visualization – Click Edit in the top right corner to make the visualization available for editing. A dialog box opens where you can choose to edit the visualization in the following ways:
Edit on all dashboards – Edit the visualization so that it's updated on all of the dashboards it's linked to.
Copy and edit – Make a copy of the visualization and update the copy.
Unlink and edit – Unlink the visualization from some or all of its linked dashboards before updating.
You can also click the view icon (
) to show a list of the dashboards the visualization is linked to. For more information about working with visualizations, see Configure and Manage Visualizations.
View visualization details – Click the options menu icon
, and select View details. A panel opens and displays visualization details, as shown in the image below, including a description, use cases, owner, chart type, and how many dashboards its linked to. To edit the visualization details click Edit details.
Copy a link to the visualization – Click the options menu icon (
), and select Copy link. A link to the visualization is copied to your clipboard.Add the visualization to a folder – Click the options menu icon (
), and select Add to folder. You can opt to add the visualization to an existing folder or add it to a new folder.Duplicate the visualization – Click the options menu icon (
), and select Duplicate. A copy of the visualization opens in edit mode so that you can modify it. For more information, see Duplicate a Visualization.Export the visualization – Click the options menu icon (
), and select Export. The visualization is exported as a config file. For more information, see Export and Import Visualizations.Delete the visualization from the library – Click the options menu icon (
), and select Delete. For more information, see Delete Visualizations from the Library.Refresh the visualization display – Click the refresh icon (
) in the upper left to manually refresh the visualization display.View data details represented by individual chart parameters – To view the numbers and other information represented by the different elements in a visualization graph, move your cursor over them. The information is displayed in tooltips, as shown in the example below.
Drill into results and pivot to Search – To drill down into a visualization chart and view the represented events in the Search service, click on a chart area or data point. Then select Show Results in Search. The Search service opens in a new tab and the search field is populated with a query string for viewing the appropriate events. Click Search to view the results in the Search service.
