Web dashboard

Use the Web dashboards to identify potential and persistent threats in your environment.

Dashboard filters

Use the available dashboard filters to refine the results displayed on the dashboard panels. The filters do not apply to key security indicators.

Filter Description
Time range Select the time range to view.
Business unit A group or department classification for the identity.
Category Filter based on the categories to which the host or user belongs.
Destination Filter by the target host, server, or web domain (IP address or URL) that receives the web traffic or HTTP request initiated by a source client.
Source Filter by the specific origin, file path, stream, or network input (such as a specific log file, script output, or port/protocol) from which the web traffic event data was ingested.
HTTP status Filter by the standard numeric response code returned by a web server or proxy for client web traffic requests.
Show only unknown categories Filters the view to display only web traffic categories that have been explicitly defined as unknown through user-created tags.
Standard deviation index Filter to control the volume of anomalous data displayed based on statistical thresholds. The percentage (%) shows the amount of data that will be filtered out if that number of standard deviations is selected. Choose a higher number of deviations to see fewer user agent strings, or choose a lower number of deviations to see a greater number of user agent strings.
HTTP method Filter by the specific request action used by a client when communicating with a web server or proxy.
URL Filter by the Uniform Resource Locator, representing the specific web address, path, or HTTP/proxy string captured from network traffic, proxy logs, or firewall data.

Key indicators

Provides an overview of account statuses. Use it to track newly active or inactive accounts, as well as those that have been inactive for a period of time but recently became active. Discover accounts that are not properly de-provisioned or inactivated when a person leaves the organization. As inactive accounts or improperly active accounts are vulnerable to attackers, it is a good idea to check this dashboard on a regular basis. You can also use this dashboard during an investigation to identify suspicious accounts and closely examine user access activity.

Key indicator Description
Unique categories Tracks the distinct, non-duplicative classification labels assigned to web or network traffic by your proxy, firewall, or security devices.
Minimum UA length Tracks the Minimum User Agent string length and used by security analysts to detect anomalies in network traffic. It measures the character count of the http_user_agent field mapped from the Web Common Information Model (CIM) data.
Mean UA length Tracks the Mean User Agent Length. This metric measures the average (arithmetic mean) character length of the HTTP User-Agent strings detected within your web or proxy traffic data over the selected timeframe.
Maximum UA length Tracks the maximum character length of an HTTP User Agent (UA)string tracked within the environment.
Stdev UA length Tracks the Standard Deviation of User Agent Length. This metric is typically found within the Web Intelligence dashboards (such as HTTP Analysis or URL Length Analysis) and is used to analyze patterns and detect anomalies in your web traffic.
Unique user agents Tracks the count of distinct, individual http_user_agent strings reported in your web access, proxy, or firewall logs over a selected time range.

Dashboard panels

Panel Description
Web search An ad-hoc search interface used to investigate web and proxy event data based on specific filter criteria.
Web events Normalized web traffic and HTTP/proxy log records captured from web proxies, secure web gateways, or web servers that conform to the Common Information Model (CIM) Web data model. It represents activities such as client browsing requests, URI visits, bandwidth consumption, and HTTP response actions.