Traffic dashboard

The Traffic dashboard profiles overall network traffic, helps detect trends in type and changes in volume of traffic, and helps to isolate the cause (for example, a particular device or source) of those changes. This helps to determine when a traffic increase is a security issue and when it is due to an unrelated problem with a server or other device on the network.

Dashboard filters

You can use the filters to limit which items are shown on the dashboard.

Filter by	Description	Action
Time range	Select the time range to view.	Drop-down: select to filter by
Business Unit	A group or department classification for the identity.	Text field. Empty by default. Wildcard strings with an asterisk (*)
Category	Filter based on the categories to which the host belongs.	Drop-down: select to filter by
Action	Filter based on firewall rule actions.	Drop-down: select to filter by
Transport Protocol	Filter based on transport protocol.	Drop-down: select to filter by
Search	Filter based on search	Text field. Empty by default. Wildcard strings with an asterisk (*)
Search entity type	Filter based on device or user	Drop-down: select to filter by

Dashboard panels

Filter by	Description	Action
Network threat finding	Number of findings generated when the network log traffic matches a known indicator of compromise (IOC) or suspicious pattern.
Mean bytes	Indicates the mean of file size (in bytes) on the network.
Traffic sources	Displays the number of top traffic sources based on the total traffic volume over the given time frame. Counts duplicate values only once.
Total count	Displays the total number of top traffic sources based on the total traffic volume over the given time frame.
Usage for well known ports	Displays the sum of protocol traffic sorted by ports under 1024 over time.
Long lived connections	Displays the persistent TCP/IP network connections that remain open for an extended period (typically longer than a few minutes) to maintain a session rather than closing immediately after a single data transfer.
Top connection sources	Displays the top hosts sending and receiving network protocol traffic.
Sessions over time	Displays the graphs for active network or user sessions chronologically.
Session details	Displays detailed information on network sessions such as user or device interactions across a network using DHCP, VPN, or authentication logs.