Security posture dashboard

The Security posture dashboard is designed to provide a high-level, centralized overview of significant security findings across all domains of your deployment in a security operations center (SOC). This dashboard helps to give analysts real-time insights and immediate situational awareness.

  • All events over the past 24 hours

  • Trends over the past 24 hours

  • A break down of findings based on security domains such as access, endpoint, or network and identify the domains that have the highest volume of findings or most recent activity

  • Grouping of events by urgency level and host, allowing analysts to immediately spot the riskiest offenders or recurring threats

  • Launch searches or transition into the Incident Review dashboard for deep-dive investigations.

Key indicators

Display the count of findings by security domain over the past 24 hours.

Indicator Description
Queues Search filter to display findings based on specific queues.
Access findings Displays the number of findings in your SOC that are related to user authentication, login sessions, and unauthorized access attempts against systems or accounts.
Endpoint findings Displays the number of findings in your SOC that are generated from the endpoint domain that appear in the analyst queue to track device-level threats.
Network findings Displays the number of findings in your SOC related to network traffic, devices, or protocols that the system detects and records for analyst review.
Identity findings Displays the number of findings in your SOC that can be grouped using user-related identity data such as usernames, emails, or source users, to track anomalous behaviors tied to a specific person.
Audit findings Displays the number of findings in your SOC that require triage, review, and workflow management.
Threat findings Displays the number findings in your SOC that represent potential security threats.

Dashboard panels

Panel Description
Findings by urgency Displays the findings by urgency in the last 24 hours. Findings by urgency uses an urgency calculation based on the priority assigned to the asset and the severity assigned to the detection. The drilldown opens the analyst queue on the Mission Control page, showing all findings with the selected urgency in the last 24 hours.
Findings over time Displays a timeline of findings by security domain. The drilldown opens the analyst queue on the Mission Control page, showing all findings in the selected security domain and time frame.
Top findings Displays the top findings by rule name, including a total count and a sparkline to represent activity spikes over time. The drilldown opens the analyst queue on the Mission Control page scoped to the selected finding rule.
Top findings sources Displays the top 10 findings by src, including a total count, a count per correlation and domain, and a sparkline to represent activity spikes over time. The drilldown opens the analyst queue on the Mission Control page scoped to the selected finding source.