Skip to main content
Version: 6.2

Cyber Security: Incident Overview

The Cyber Security: Incident Overview dashboard shows the number and severity of incidents registered by the module's rules, as well as their trends over time. It helps identify which rules, data sources, and MITRE ATT&CK techniques are associated with the most incidents.

Intended for: SOC analysts and information security managers.

Data source: module incidents in Incident Manager.

Main Sections​

Shows totals for the selected period and changes in incident counts over time.

  • total number of incidents
  • number of high-, medium-, and low-severity incidents
  • number of triggered rules
  • incident trends broken down by severity

2. Distribution and Incidents by Rule​

Shows how incidents are distributed across categories and which rules registered them.

  • incidents by data source
  • rules with the most incidents
  • MITRE ATT&CK techniques with the most incidents
  • table of rules with severity, incident count, and time of the first and last incident

Selecting a table row opens the Cyber Security: Attacked Assets dashboard filtered by the selected rule.