Intrusion Detection dashboard

The Intrusion Detection dashboard provides an overview of all network intrusion events from Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) device data. This dashboard assists in reporting on IDS activity to display trends in severity and in volume of IDS events.

The dashboard is used in ad-hoc searching of network data, but is also the primary destination for drilldown searches used in the dashboard panels.

Intrusion detection filters

The dashboard assists in searching IDS-related events such as attacks or reconnaissance-related activity, based on the criteria defined by the search filters.

Filter by Description
Time range Select the time range to view.
Destination Filter by the target host, endpoint, or network address that is the target of the detected attack or malicious traffic pattern.
Source Filter by the originator of the network attack or intrusion attempt.
Severity Filter based on event severity.
Signature Filter by the name or identifier of the specific intrusion or attack pattern that was detected by an Intrusion Detection System (IDS) or Intrusion Prevention System (IPS).
IDS category Filter based on events matching vendor-defined categories.
IDS type Filter based on events matching a specified type of IDS.

Dashboard Panels

Panel Description
Intrusion detection search An ad-hoc investigation view designed to search and analyze normalized IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) events.
Intrusion detection events Displays security log data generated by an intrusion detection system (IDS) or intrusion prevention system (IPS) that tracks suspicious network traffic, attacks, or reconnaissance activities.
New Attacks - Last 30 Days Displays attacks that have been identified for the first time. New attack vectors indicate that a change has occurred on the network, potentially due to the presence of a new threat, such as a new malware infection.