Cyber Security: Dashboards

Incident Dashboards

These dashboards show incidents registered by the module's rules.

Dashboard	Purpose
Cyber Security: Incident Overview	incident counts and severity, trends over time, and distribution by data source, rule, and MITRE ATT&CK technique
Cyber Security: Attacking Assets	source addresses and accounts used to initiate attacks, and the number of incidents and rules for each asset
Cyber Security: Attacked Assets	attacked hosts, destination addresses, target accounts, and critical assets identified by the module lookup

The dashboards are linked. Selecting a rule in the overview opens the attacked assets for that rule. Selecting an incident on an asset dashboard opens the related dashboard. All three dashboards provide filters for period, data source, severity, and rule.

Data Source Dashboards

These dashboards monitor events from the corresponding data sources. Each dashboard group's page lists its sources and data model requirements.

Group	Purpose
Authentication	authentication attempts on hosts, in applications, and over remote connections; user and source profiles
Account Management	creation, modification, and deletion of user, group, and computer accounts
Email	email traffic, delivery statuses, and sender and recipient profiles
Intrusion Detection	threats, their sources, and targets reported by intrusion detection systems
Malware	malware detection and blocking by antivirus tools
Network	network traffic statistics, illegitimate connections, and scans
Vulnerabilities	vulnerability scan results
Web	web server request statistics

Incident Overview

Cyber Security incident counts, severity, trends, and distribution by source, rule, and MITRE ATT&CK technique.

Attacking Assets

Source addresses and accounts used to initiate attacks, based on Cyber Security incidents.

Attacked Assets

Attacked hosts, destination addresses, and target accounts, based on Cyber Security incidents.

Authentication

The Authentication section is intended for monitoring authorization and authentication events on hosts, in applications, and during remote connections.

Account Management

Monitoring the creation, modification, and deletion of user, group, and workstation accounts.

Email

The Email section is designed for monitoring email traffic, spam distribution, violations of corporate email usage policies, and phishing attempts.

Intrusion Detection

Monitoring threats, their sources, and targets reported by intrusion detection systems.

Malware

Monitoring malware detection and blocking events.

Network

Monitoring network traffic, illegitimate connections, and unauthorized scanning.

Vulnerabilities

Monitoring vulnerability scan results and their distribution by host and severity.

Web

Monitoring web server requests, response codes, and traffic volume.