Endpoint dashboard

The Endpoint dashboard provides insight into malware events including viruses, worms, spyware, attack tools, adware, and PUPs (Potentially Unwanted Programs), as well as your endpoint protection deployment.

The Endpoint dashboard uses the Splunk change monitoring system, which detects file-system and registry changes, to illustrate changes and highlight trends in the endpoints in your environment. For example, Endpoint Changes can help discover and identify a sudden increase in changes that may be indicative of a security incident.

You can select elements or table rows on this dashboard to display raw events.

Dashboard filters

Use the filters to refine which events are shown.

Filter by Description
Time range Select the time range to represent.
Business unit A group or department classification for the identity.
Category Filter based on the categories to which the malware belongs.
Destination Filter by the specific endpoint machine, host, or device targeted or reported on in an event.
Show only systems that should time sync Lets you include or exclude assets based on whether they are configured to require Network Time Protocol (NTP) synchronization.
System Filters by host-level configuration, performance statistics, and operational data.

Key metrics or key indicators

The following table describes the key indicators for this dashboard.

Key indicator Description
Update service anomalies Tracks the number of unexpected statuses, failures, or disabled states in essential operating system patch or update services (such as Windows Update or package managers) across your network's endpoints.

Dashboard panels

The following table describes the panels for this dashboard.

Panel Description
Endpoint changes by action Summarizes changes over time. A substantial increase in changes may indicate the presence of an incident that is causing changes on the endpoints such as a virus or worm.
Endpoint changes by type Summarizes the type of changes observed on the endpoints, such as file or registry changes.
Endpoint changes by system Summarizes changes by system
Operating systems Tracks the specific host operating system types (such as Windows, Linux, or macOS) across your network's devices.
Service by system count Displays active network services ordered by the total number of systems (hosts/endpoints) on which they are running.
Ports by system count Tracks the transport method and destination ports, ordered by the number of systems on which they are present.
Time service start mode anomalies Tracks unexpected or unauthorized changes in how the Windows Time service (W32Time) or similar core time synchronization services are configured to start on network endpoints.
Recent endpoint changes Shows the most recent endpoint changes observed.